Edit tour

Windows Analysis Report
Teams.exe

Overview

General Information

Sample name:	Teams.exe
Analysis ID:	1462647
MD5:	bc40d343632f54712a794d8b699925a9
SHA1:	103e982c4767c799894152e0a58a59d55971052c
SHA256:	0bb16506d1f5c422644435a7dafd379c96f136f4e68703a45266066694ede59e
Infos:

Detection

NetSupport RAT

Score:	51
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	33
Range:	0 - 100

Signatures

Antivirus detection for URL or domain

Multi AV Scanner detection for submitted file

Contain functionality to detect virtual machines

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Abnormal high CPU Usage

Allocates memory with a write watch (potentially for evading sandboxes)

Binary contains a suspicious time stamp

Contains functionality for read data from the clipboard

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to download and execute PE files

Contains functionality to download and launch executables

Contains functionality to dynamically determine API calls

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Contains functionality to launch a process as a different user

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to read the PEB

Contains functionality to read the clipboard data

Contains functionality to record screenshots

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected potential crypto function

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

EXE planting / hijacking vulnerabilities found

Extensive use of GetProcAddress (often used to hide API calls)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found dropped PE file which has not been started or loaded

Found evasive API chain checking for process token information

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Installs a raw input device (often for capturing keystrokes)

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

PE file contains sections with non-standard names

PE file does not import any functions

Potential key logger detected (key state polling based)

Queries information about the installed CPU (vendor, model number etc)

Queries keyboard layouts

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Registers a DLL

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Suspicious Schtasks From Env Var Folder

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Yara detected Keylogger Generic

Yara detected NetSupport remote tool

Classification

Process Tree

System is w10x64

Teams.exe (PID: 6036 cmdline: "C:\Users\user\Desktop\Teams.exe" MD5: BC40D343632F54712A794D8B699925A9)

schtasks.exe (PID: 5296 cmdline: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7128 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

client32.exe (PID: 5244 cmdline: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe MD5: 9497AECE91E1CCC495CA26AE284600B9)

MSTeamsSetup_c_l_.exe (PID: 5232 cmdline: C:\ProgramData\MSTeamsSetup_c_l_.exe MD5: CF0E0F57B68A11D099EC944200A6069D)

MSTeamsSetup_c_l_.exe (PID: 2820 cmdline: "C:\ProgramData\MSTeamsSetup_c_l_.exe" --rerunningWithoutUAC MD5: CF0E0F57B68A11D099EC944200A6069D)

Update.exe (PID: 3620 cmdline: "C:\Users\user\AppData\Local\SquirrelTemp\Update.exe" --install . --rerunningWithoutUAC --exeName=MSTeamsSetup_c_l_.exe --bootstrapperMode MD5: 8F0E958D7EF57D727ADCDA1C67C24C2B)

Squirrel.exe (PID: 6688 cmdline: "C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe" --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe MD5: 17927E3240D3B0212A4B93C1D45F92B0)

Teams.exe (PID: 4444 cmdline: "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-install 1.7.00.15969 MD5: E20A8E5630CFCAD496816E211D212EAC)

Teams.exe (PID: 3812 cmdline: "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-firstrun MD5: E20A8E5630CFCAD496816E211D212EAC)

Teams.exe (PID: 2316 cmdline: "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2 MD5: E20A8E5630CFCAD496816E211D212EAC)

Teams.exe (PID: 5136 cmdline: "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8 MD5: E20A8E5630CFCAD496816E211D212EAC)

regsvr32.exe (PID: 5248 cmdline: "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

regsvr32.exe (PID: 6388 cmdline: /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll" MD5: B0C2FA35D14A9FAD919E99D9D75E1B9E)

regsvr32.exe (PID: 5456 cmdline: "C:\Windows\SysWOW64\regsvr32.exe" /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

client32.exe (PID: 1272 cmdline: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe MD5: 9497AECE91E1CCC495CA26AE284600B9)

cleanup

Yara Signatures

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\CSCOClient\pcicapi.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\Microsoft\Teams\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Roaming\CSCOClient\PCICL32.DLL	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
C:\Users\user\AppData\Roaming\CSCOClient\PCICL32.DLL	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Roaming\CSCOClient\AudioCapture.dll	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 3 entries

Memory Dumps

Source	Rule	Description	Author
00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: Teams.exe PID: 6036	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 5244	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Process Memory Space: client32.exe PID: 1272	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
Process Memory Space: client32.exe PID: 1272	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
Click to see the 3 entries

Unpacked PEs

Source	Rule	Description	Author
7.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
3.0.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.6c640000.3.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.400000.0.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
7.2.client32.exe.111b3150.2.raw.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.111b3150.2.raw.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
8.0.Update.exe.690000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_Keylogger_Generic	Yara detected Keylogger Generic	Joe Security
7.2.client32.exe.11000000.1.unpack	JoeSecurity_NetSupport	Yara detected NetSupport remote tool	Joe Security
12.0.Squirrel.exe.b30000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
Click to see the 5 entries

Sigma Signatures

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST, CommandLine: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST, CommandLine|base64offset|contains: j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\Desktop\Teams.exe", ParentImage: C:\Users\user\Desktop\Teams.exe, ParentProcessId: 6036, ParentProcessName: Teams.exe, ProcessCommandLine: "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST, ProcessId: 5296, ProcessName: schtasks.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: https://whispry.com/zl/kc.zip

Avira URL Cloud: Label: malware

Multi AV Scanner detection for submitted file

Source: Teams.exe

ReversingLabs: Detection: 25%

Privilege Escalation

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\Teams.exe	EXE: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\Microsoft\Teams\packages\RELEASES.exe	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	EXE: C:\Users\user\AppData\Roaming\CSCOClient\remcmdstub.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\Microsoft\Teams\Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	EXE: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to behavior

Compliance

EXE planting / hijacking vulnerabilities found

Source: C:\Users\user\Desktop\Teams.exe	EXE: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\Microsoft\Teams\packages\RELEASES.exe	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	EXE: C:\Users\user\AppData\Roaming\CSCOClient\remcmdstub.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\Microsoft\Teams\Update.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	EXE: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	EXE: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to behavior

Uses 32bit PE files

Source: Teams.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Creates install or setup log file

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\SquirrelTemp\SquirrelSetup.log			Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\SquirrelSetup.log			Jump to behavior

PE / OLE file has a valid certificate

Source: Teams.exe

Static PE information: certificate valid

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: netstandard.pdb.mdb source: Update.exe, 00000008.00000002.3517726832.00000000042E3000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3517726832.0000000004752000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000000.2136346830.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, Squirrel.exe, 0000000C.00000000.3381098189.0000000000B5F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: kbdbgph.pdbGCTL source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdazel.pdbGCTL source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdbash.pdbGCTL source: Teams.exe, 00000000.00000003.2071938218.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071938218.0000000000879000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdbash.pdb source: Teams.exe, 00000000.00000003.2071938218.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071938218.0000000000879000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BuildAgent\work\che-trunk-git-yandex-ru\win\YandexDiskUploaderSetup\Release\YandexDiskSetup.pdb source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\src\Setup\bin\Release\Setup.pdb/ source: MSTeamsSetup_c_l_.exe, 00000005.00000000.2132512592.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000006.00000002.3550890669.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000006.00000000.2133601797.0000000000086000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\src\Setup\bin\Release\Setup.pdb source: MSTeamsSetup_c_l_.exe, 00000005.00000000.2132512592.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000006.00000002.3550890669.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000006.00000000.2133601797.0000000000086000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: kbdaze.pdbGCTL source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073428564.0000000000872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdaze.pdb source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073428564.0000000000872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbd106n.pdbGCTL source: Teams.exe, 00000000.00000003.2088427922.000000000085B000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071473492.000000000085C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdazel.pdb source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdarme.pdbGCTL source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdbgph.pdb source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbd106n.pdb source: Teams.exe, 00000000.00000003.2088427922.000000000085B000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071473492.000000000085C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdarme.pdb source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1280\1280\ctl32\release_unicode\pcicapi.pdb source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.2142416380.000000006C645000.00000002.00000001.01000000.00000009.sdmp

Spreading

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0007C0A5 FindFirstFileExW,	5_2_0007C0A5
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00056982 SHGetFolderPathW,CreateDirectoryW,GetLastError,SHGetFolderPathW,GetUserNameW,GetLastError,CreateDirectoryW,GetLastError,FindResourceW,LoadResource,SizeofResource,LockResource,DeleteFileW,FreeResource,GetFileAttributesW,GetModuleHandleW,GetModuleFileNameW,PathFileExistsW,CopyFileW,FindFirstFileW,GetLastError,FindClose,CreateProcessW,WaitForSingleObject,GetExitCodeProcess,DeleteFileW,CloseHandle,CloseHandle,FreeResource,	5_2_00056982
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1110C060 GetLocalTime,wsprintfA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,ExpandEnvironmentStringsA,CreateFileA,timeBeginPeriod,GetLocalTime,timeGetTime,WriteFile,	7_2_1110C060
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1102D212 GetModuleFileNameA,GetFileAttributesA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D212
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1102D516 GetModuleFileNameA,GetFileAttributesA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D516
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11123B60 GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_11123B60

Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Teams\current	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Teams	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

Yara detected Generic Downloader

Source: Yara match	File source: 8.0.Update.exe.690000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.0.Squirrel.exe.b30000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Teams\Update.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe, type: DROPPED

Contains functionality to download and execute PE files

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_0005136F __EH_prolog3_GS,GetActiveWindow,GetTempPathW,GetTempFileNameW,_wcsrchr,MoveFileW,CoCreateInstance,URLDownloadToFileW,ShellExecuteExW,WaitForSingleObject,GetExitCodeProcess,CloseHandle,DeleteFileW,

5_2_0005136F

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 52.113.194.132 52.113.194.132
Source: Joe Sandbox View	IP Address: 2.19.126.151 2.19.126.151
Source: Joe Sandbox View	IP Address: 20.189.173.18 20.189.173.18
Source: Joe Sandbox View	IP Address: 20.189.173.4 20.189.173.4
Source: Joe Sandbox View	IP Address: 52.182.143.213 52.182.143.213

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

5_2_0005136F

Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: V8.MemoryHeapUsedV8.MemoryHeapCommittedmail.google.com.gmaildrive.google.com.docsplus.google.com.plusinbox.google.com.inboxcalendar.google.com.calendarwww.youtube.com.youtube.top10sina.com.cnfacebook.combaidu.comqq.comtwitter.comtaobao.comlive.com equals www.youtube.com (Youtube)
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: chttps://www.baidu.com/s?ie={inputEncoding}&wd={searchTerms}https://www.baidu.com/s?ie={inputEncoding}&word={searchTerms}https://www.baidu.com/{google:pathWildcard}/s?ie={inputEncoding}&word={searchTerms}{google:baseURL}#q={searchTerms}{google:baseURL}search#q={searchTerms}{google:baseURL}webhp#q={searchTerms}{google:baseURL}s#q={searchTerms}{google:baseURL}s?q={searchTerms}https://go.mail.ru/msearch?q={searchTerms}&{mailru:referralID}https://m.so.com/s?ie={inputEncoding}&q={searchTerms}https://m.so.com/index.php?ie={inputEncoding}&q={searchTerms}https://m.sogou.com/web/{google:pathWildcard}?ie={inputEncoding}&keyword={searchTerms}http://searchatlas.centrum.cz/?q={searchTerms}http://hladaj.atlas.sk/fulltext/?phrase={searchTerms}http://isearch.avg.com/search?q={searchTerms}http://search.avg.com/route/?q={searchTerms}&lng={language}https://isearch.avg.com/search?q={searchTerms}https://search.avg.com/route/?q={searchTerms}&lng={language}http://search.babylon.com/?q={searchTerms}http://search.conduit.com/Results.aspx?q={searchTerms}http://www.delfi.lt/paieska/?q={searchTerms}http://www.delta-search.com/?q={searchTerms}http://www1.delta-search.com/home?q={searchTerms}http://www1.delta-search.com/?q={searchTerms}http://www2.delta-search.com/home?q={searchTerms}http://www2.delta-search.com/?q={searchTerms}http://www.search.delta-search.com/home?q={searchTerms}http://www.search.delta-search.com/?q={searchTerms}http://www.yhs.delta-search.com/home?q={searchTerms}http://www.yhs.delta-search.com/?q={searchTerms}http://mixidj.delta-search.com/home?q={searchTerms}http://mixidj.delta-search.com/?q={searchTerms}http://search.goo.ne.jp/web.jsp?MT={searchTerms}&IE={inputEncoding}http://search.goo.ne.jp/sgt.jsp?MT={searchTerms}&CL=plugin&FM=json&IE={inputEncoding}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Default.aspx#q={searchTerms}http://search.iminent.com/SearchTheWeb/v6/1033/homepage/Result.aspx#q={searchTerms}http://start.iminent.com/?q={searchTerms}http://start.iminent.com/StartWeb/1033/homepage/#q={searchTerms}http://search.incredibar.com/?q={searchTerms}http://mystart.incredibar.com/?search={searchTerms}https://www.neti.ee/cgi-bin/otsing?query={searchTerms}&src=webhttps://www.neti.ee/api/suggestOS?suggestVersion=1&suggestQuery={searchTerms}https://nova.rambler.ru/search?query={searchTerms}https://nova.rambler.ru/suggest?v=3&query={searchTerms}http://www.search-results.com/web?q={searchTerms}http://search.snap.do/?q={searchTerms}http://feed.snapdo.com/?q={searchTerms}http://feed.snap.do/?q={searchTerms}http://en.softonic.com/s/{searchTerms}http://www.softonic.com/s/{searchTerms}http://www.softonic.com.br/s/{searchTerms}http://buscador.softonic.com/?q={searchTerms}http://nl.softonic.com/s/{searchTerms}https://search.softonic.com/?q={searchTerms}https://en.softonic.com/s/{searchTerms}https://www.softonic.com/s/{searchTerms}https://www.softonic.com.br/s/{searchTerms}https://buscador.softonic.com/?q={searchTerms}https://nl.softonic.com/s/{searchTer
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)

Source: client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp, Teams.exe, 0000000D.00000000.3410252476.00007FF6FE2C9000.00000002.00000001.01000000.00000013.sdmp, Teams.exe, 0000000E.00000000.3446098723.00007FF6FE2C9000.00000002.00000001.01000000.00000013.sdmp	String found in binary or memory: http://127.0.0.1
Source: client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://127.0.0.1RESUMEPRINTING
Source: Update.exe, 00000008.00000002.3512878472.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a1813.dscd.akamai.net
Source: Update.exe, 00000008.00000002.3512878472.00000000030F0000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://a1813.dscd.akamai.netd
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://contact2.yandex.com.tr/disk/?log=%
Source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
Source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
Source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSACodeSigningCA.crl0s
Source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
Source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.000000000087C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
Source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSACodeSigningCA.crt0#
Source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
Source: Update.exe, 00000008.00000002.3512878472.00000000030D6000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Teams.nuspec
Source: Update.exe, 00000008.00000002.3512878472.00000000030D6000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/Teams.nuspecd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/Squirrel.exe
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/Squirrel.exed
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/Teams.exe
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/Teams.exed
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-console-l1-2-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-console-l1-2-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-datetime-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-datetime-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-debug-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-debug-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-errorhandling-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-errorhandling-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-file-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-file-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-file-l1-2-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-file-l1-2-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-file-l2-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-file-l2-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-heap-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-heap-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-interlocked-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-interlocked-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-localization-l1-2-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-localization-l1-2-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-memory-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-memory-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-processthreads-l1-1-1.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-processthreads-l1-1-1.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-rtlsupport-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-rtlsupport-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-synch-l1-2-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-synch-l1-2-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-timezone-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-core-timezone-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-conio-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-filesystem-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-filesystem-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-heap-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-heap-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-multibyte-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-multibyte-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-runtime-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-runtime-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-stdio-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-stdio-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-string-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-string-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-time-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-time-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-utility-l1-1-0.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/api-ms-win-crt-utility-l1-1-0.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/chrome_100_percent.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/chrome_100_percent.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/chrome_200_percent.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/chrome_200_percent.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/concrt140.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/concrt140.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/icudtl.dat
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/icudtl.datd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/libEGL.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/libEGL.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/libGLESv2.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/libGLESv2.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/af.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/af.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/am.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/am.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/bn.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/bn.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/ca.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/ca.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/da.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/da.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/de.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/de.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/el.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/el.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/en-US.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/en-US.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/es-419.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/es-419.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/et.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/et.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/fa.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/fa.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/fil.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/fil.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/gu.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/gu.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/he.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/he.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/hi.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/hi.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/hr.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/hr.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/id.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/id.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/kn.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/kn.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/ko.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/ko.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/pl.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/pl.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/ro.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/ro.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/sk.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/sk.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/sr.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/sr.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/sv.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/sv.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/sw.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/sw.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/te.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/te.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/th.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/th.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/tr.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/tr.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/zh-CN.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/locales/zh-CN.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/msvcp140.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/msvcp140.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/msvcp140_1.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/msvcp140_1.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/msvcp140_2.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/msvcp140_2.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/Update.VisualElementsManifest.xml
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/Update.VisualElementsManifest.xmld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/keyboard-layout/build/Rel
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/m365-browser/build/Releas
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/native-utils/build/Releas
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/office-int-win/build/Rele
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/RtmCodecs.dl
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/RtmControl.d
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/SlimCV.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/SlimCV.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/cm.slim
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/cm.slimd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/onnxruntime.
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/qm.slim
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/qm.slimd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/sharing-indi
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/skypert.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/skypert.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/slimcore.nod
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/ssScreenVVS2
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-available.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-available.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-away.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-away.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-busy.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-busy.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-dnd.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-dnd.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-reset.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/12x12-reset.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/20x20-available.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/20x20-available.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/20x20-dnd.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/20x20-dnd.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_2.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_2.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_4.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_4.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_5.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_5.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_7.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_7.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_8.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_8.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_9.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_9.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_9plus.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Badge_9plus.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Taskbar.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/Taskbar.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/TeamsIconSet.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/TeamsIconSet.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/blueberryTaskbar.ico
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/blueberryTaskbar.icod
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/dlp_user_profile.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/dlp_user_profile.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/msix/teams-app-icon-150.targetsize-150_altform-un
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/msix/teams-app-icon-44.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/msix/teams-app-icon-44.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/send.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/send.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/tlb/Uc.win32.tlb
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/tlb/Uc.win32.tlbd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/urgent-icon.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/urgent-icon.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/windows/TeamsLogo.contrast-white_scale-100.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/windows/TeamsLogo.contrast-white_scale-100.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/windows/TeamsLogoSmall.contrast-white_scale-100.p
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/windows/TeamsLogoSmall.scale-100.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/windows/TeamsLogoSmall.scale-100.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/windows/TeamsSquare44x44Logo.contrast-black_scale
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/windows/TeamsSquare44x44Logo.scale-100.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/assets/windows/TeamsSquare44x44Logo.scale-100.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ar-sa.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ar-sa.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ca-es-valencia.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ca-es-valencia.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-de-de.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-de-de.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-el-gr.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-el-gr.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-en-au.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-en-au.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-es-mx.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-es-mx.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-eu-es.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-eu-es.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-fi-fi.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-fi-fi.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-fil-ph.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-fil-ph.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-fr-fr.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-fr-fr.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-gl-es.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-gl-es.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-he-il.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-he-il.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-hu-hu.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-hu-hu.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-id-id.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-id-id.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ka-ge.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ka-ge.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ko-kr.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ko-kr.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-lv-lv.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-lv-lv.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-nb-no.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-nb-no.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-nl-nl.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-nl-nl.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-nn-no.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-nn-no.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-pseudo.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-pseudo.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-pt-pt.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-pt-pt.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ro-ro.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ro-ro.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ru-ru.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-ru-ru.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-sk-sk.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-sk-sk.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-sl-si.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-sl-si.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-sq-al.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-sq-al.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-uk-ua.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-uk-ua.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-zh-cn.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/locales/locale-zh-cn.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/AddinInstaller.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/AddinInstaller.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Assets/NewMeeting_Large_14
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Assets/NewMeeting_Large_19
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Assets/NewMeeting_Small_12
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Assets/NewMeeting_Small_19
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Microsoft.Applications.Tel
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Microsoft.IdentityModel.Lo
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Microsoft.Teams.Diagnostic
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Microsoft.Teams.MeetingAdd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Microsoft.Web.WebView2.Cor
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Newtonsoft.Json.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/Newtonsoft.Json.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/OneAuth.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/OneAuth.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/System.IdentityModel.Token
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/adal2-meetingaddin.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/adal2-meetingaddin.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/ar-SA/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/ca-ES/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/cs-CZ/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/cy-GB/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/el-GR/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/en-GB/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/es-MX/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/et-EE/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/fi-FI/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/fr-FR/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/hu-HU/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/id-ID/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/is-IS/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/ja-JP/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/ko-KR/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/lv-LV/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/msvcp140.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/msvcp140.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/nb-NO/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/nn-NO/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/pl-PL/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/pt-BR/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/pt-PT/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/ro-RO/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/ru-RU/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/runtimes/win-x64/native/We
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/sv-SE/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/th-TH/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/tr-TR/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/vcruntime140.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/vcruntime140.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/vi-VN/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/zh-TW/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Assets/NewMeeting_Large_14
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Assets/NewMeeting_Large_19
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Assets/NewMeeting_Large_96
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Assets/NewMeeting_Small_12
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Assets/NewMeeting_Small_14
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Assets/NewMeeting_Small_19
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Assets/NewMeeting_Small_96
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Microsoft.IdentityModel.Lo
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Microsoft.Teams.Diagnostic
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Microsoft.Teams.MeetingAdd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Microsoft.Web.WebView2.Win
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Newtonsoft.Json.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Newtonsoft.Json.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/System.IdentityModel.Token
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/System.Net.Http.Formatting
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/bg-BG/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/ca-ES/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/cs-CZ/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/cy-GB/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/da-DK/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/es-ES/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/es-MX/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/et-EE/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/fi-FI/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/he-IL/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/hu-HU/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/id-ID/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/is-IS/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/it-IT/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/lt-LT/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/msvcp140.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/msvcp140.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/nl-NL/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/nn-NO/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/pl-PL/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/pt-PT/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/ro-RO/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/ru-RU/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/sk-SK/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/sl-SI/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/sr-Latn-RS/Microsoft.Teams
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/sv-SE/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/tr-TR/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/vi-VN/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/zh-CN/Microsoft.Teams.Meet
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/tmp/Teams/resources/ThirdPartyNotice.txt
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/resources/tmp/Teams/resources/ThirdPartyNotice.txtd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/snapshot_blob.bin
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/snapshot_blob.bind
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/v8_context_snapshot.bin
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/v8_context_snapshot.bind
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/vcruntime140.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/vcruntime140.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/vcruntime140_1.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/vcruntime140_1.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/vk_swiftshader.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/vk_swiftshader.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/vulkan-1.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/lib/net45/vulkan-1.dlld
Source: Update.exe, 00000008.00000002.3512878472.00000000030D6000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/package/services/metadata/core-properties/5961463727b542b0b7fbd025c76ab66e.p
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.asar
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.asard
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.bin
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.bind
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.bsdiff
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.bsdiffd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.config
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.configd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.dat
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.datd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.diff
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.diffd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.dll
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.dlld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.exe
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.exed
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.ftz
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.ftzd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.html
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.htmld
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.ico
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.icod
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.json
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.jsond
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.node
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.noded
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.nuspec
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.nuspecd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.pak
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.pakd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.png
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.pngd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.pri
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.prid
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.psmdcp
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.psmdcpd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.rels
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.relsd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.shasum
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.shasumd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.slim
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.slimd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.tlb
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.tlbd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.txt
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.txtd
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.xml
Source: Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://defaultcontainer/tempfiles/sample.xmld
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://disk.yandex.com
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://disk.yandex.com.tr
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://disk.yandex.com.tr/download/YandexDiskSetupPack.exe/
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://disk.yandex.com/download/YandexDiskSetupPack.exe/
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://disk.yandex.compromo
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://feedback2.yandex.com/disk/desktop/?fileaddr=%
Source: client32.exe, client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.asp
Source: client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	String found in binary or memory: http://geo.netsupportsoftware.com/location/loca.aspSetChannel(%s)
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://legal.yandex.com.tr/browser_agreement/
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://legal.yandex.com.tr/desktop_software_agreement/
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://legal.yandex.com/browser_agreement/
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://legal.yandex.com/desktop_software_agreement/
Source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.comodoca.com0
Source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.sectigo.com0
Source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.000000000087C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://s2.symcb.com0
Source: Update.exe, 00000008.00000002.3512878472.00000000030D6000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.openxmlformats.or
Source: Update.exe, 00000008.00000002.3512878472.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crl0f
Source: Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcd.com0&
Source: Update.exe, 00000008.00000002.3512878472.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.00000000030E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://statics.teams.cdn.office.net
Source: Update.exe, 00000008.00000002.3512878472.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.00000000030E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://statics.teams.cdn.office.netd
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crl0f
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcb.com/sv.crt0
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sv.symcd.com0&
Source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.000000000087C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.000000000087C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.000000000087C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: client32.exe, 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp
Source: client32.exe, 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.netsupportschool.com/tutor-assistant.asp11(
Source: Teams.exe, 00000000.00000003.2072553970.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.netsupportsoftware.com
Source: client32.exe, 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.pci.co.uk/support
Source: client32.exe, 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmp	String found in binary or memory: http://www.pci.co.uk/supportsupport
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/cps0(
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.symauth.com/rpa00
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: http://www.winimage.com/zLibDll
Source: Update.exe, 00000008.00000002.3517726832.00000000042E3000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3517726832.0000000004752000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000000.2136346830.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, Squirrel.exe, 0000000C.00000000.3381098189.0000000000B5F000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://api.github.com/#
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072553970.0000000000878000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://disk.yandex.com.tr/auth/token
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://disk.yandex.com/auth/token
Source: Update.exe, 00000008.00000002.3517726832.00000000042E3000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3517726832.0000000004752000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000000.2136346830.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, Squirrel.exe, 0000000C.00000000.3381098189.0000000000B5F000.00000002.00000001.01000000.00000012.sdmp	String found in binary or memory: https://github.com/myuser/myrepo
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://log.disk.yandex.net/X-Filename:
Source: Update.exe, 00000008.00000002.3512878472.0000000002CCB000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://pipe.int.trafficmanager.net/Collector/3.0/t-sq
Source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0C
Source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sectigo.com/CPS0D
Source: Update.exe, 00000008.00000002.3512878472.0000000002D66000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.00000000030E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statics.teams.cdn.office.net
Source: Update.exe, 00000008.00000002.3512878472.00000000030D6000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.00000000030E6000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statics.teams.cdn.office.net/evergreen-assets/icons/microsoft_teams_logo_refresh.ico
Source: Update.exe, 00000008.00000002.3512878472.0000000002D66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statics.teams.cdn.office.net/produc
Source: Update.exe, 00000008.00000002.3517726832.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002D66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statics.teams.cdn.office.net/production-windows-x64/1.7.00.15969/RELEASES.exe
Source: Update.exe, 00000008.00000002.3517726832.0000000003FD1000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statics.teams.cdn.office.net/production-windows-x64/1.7.00.15969/Teams-1.7.00.15969-full.nup
Source: Update.exe, 00000008.00000002.3512878472.0000000002D66000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://statics.teams.cdn.office.net/production-windows-x64/1.7.00.15969/qw
Source: Update.exe, 00000008.00000002.3512878472.0000000002D36000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002D47000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.00000000030F0000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002DC1000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://teams.nel.measure.office.net/api/report?cat=teams
Source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whispry.com/
Source: Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whispry.com/es
Source: Teams.exe, 00000000.00000003.2072025695.0000000000817000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072147458.0000000000811000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071966732.0000000000810000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.000000000080A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whispry.com/zl/kc.zip
Source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whispry.com/zl/kc.zipk
Source: Teams.exe, 00000000.00000003.2088427922.000000000080A000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whispry.com/zl/kd.zip
Source: Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whispry.com/zl/kd.zipH
Source: Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://whispry.com/zl/kd.zipn
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://yandex.com.tr/support/disk-desktop-windows/installation.html#dont-install
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://yandex.com/support/disk-desktop-windows/installation.html#dont-install
Source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	String found in binary or memory: https://yandex.com/support/disk-desktop-windows/installation.html#dont-installinfo

Key, Mouse, Clipboard, Microphone and Screen Capturing

Contains functionality for read data from the clipboard

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_11032510 OpenClipboard,

7_2_11032510

Contains functionality to modify clipboard data

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1101F5B0 OpenClipboard,GlobalAlloc,GlobalLock,_memmove,GlobalUnlock,EmptyClipboard,SetClipboardData,GlobalFree,MessageBeep,CloseClipboard,		7_2_1101F5B0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11032AD0 GetClipboardFormatNameA,SetClipboardData,		7_2_11032AD0

Contains functionality to read the clipboard data

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_11032850 IsClipboardFormatAvailable,GetClipboardData,GetClipboardFormatNameA,GetLastError,GlobalUnlock,

7_2_11032850

Contains functionality to record screenshots

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_11007730 LoadCursorA,SetCursor,GetDC,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,CreateDCA,CreateCompatibleDC,CreateCompatibleBitmap,SelectObject,SelectClipRgn,BitBlt,SelectClipRgn,DeleteObject,DeleteDC,BitBlt,ReleaseDC,CreatePen,CreateSolidBrush,GetSysColor,LoadBitmapA,_swscanf,CreateFontIndirectA,GetStockObject,GetObjectA,CreateFontIndirectA,GetWindowRect,SetWindowTextA,GetSystemMetrics,GetSystemMetrics,SetWindowPos,UpdateWindow,SetCursor,

7_2_11007730

Installs a raw input device (often for capturing keystrokes)

Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp

Binary or memory string: RegisterRawInputDevices() failed for RIDEV_REMOVE

memstr_4af029fe-8

Potential key logger detected (key state polling based)

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_11110DF0 PeekMessageA,GetKeyState,GetKeyState,GetKeyState,Sleep,GetKeyState,

7_2_11110DF0

Yara detected Keylogger Generic

Source: Yara match	File source: 7.2.client32.exe.111b3150.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: client32.exe PID: 1272, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\CSCOClient\PCICL32.DLL, type: DROPPED

System Summary

Abnormal high CPU Usage

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Process Stats: CPU usage > 49%

Contains functionality to communicate with device drivers

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_1100A1C0: DeviceIoControl,

7_2_1100A1C0

Contains functionality to launch a process as a different user

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_11159ED0 FindWindowA,CreateProcessAsUserA,GetLastError,WinExec,CloseHandle,CloseHandle,CloseHandle,WinExec,

7_2_11159ED0

Contains functionality to shutdown / reboot the system

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00051955 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,	5_2_00051955
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1102D212 GetModuleFileNameA,GetFileAttributesA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D212
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1102D516 GetModuleFileNameA,GetFileAttributesA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D516

Detected potential crypto function

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00063140	5_2_00063140
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0005426D	5_2_0005426D
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00066290	5_2_00066290
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0006633D	5_2_0006633D
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00054608	5_2_00054608
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_000666AF	5_2_000666AF
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0006A6F7	5_2_0006A6F7
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_000556FA	5_2_000556FA
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_000537E3	5_2_000537E3
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0006A926	5_2_0006A926
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00066959	5_2_00066959
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0007AA89	5_2_0007AA89
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0006AB55	5_2_0006AB55
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00066C20	5_2_00066C20
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0006EC80	5_2_0006EC80
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0007FD1E	5_2_0007FD1E
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00078EA4	5_2_00078EA4
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00066EDB	5_2_00066EDB
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1101C030	7_2_1101C030
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1107F340	7_2_1107F340
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11072270	7_2_11072270
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1115F580	7_2_1115F580
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1102B470	7_2_1102B470
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11029480	7_2_11029480
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11113790	7_2_11113790
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_111637E5	7_2_111637E5
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_110088EB	7_2_110088EB
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1101BBF0	7_2_1101BBF0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1115AD10	7_2_1115AD10
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11032C00	7_2_11032C00
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1101CE50	7_2_1101CE50
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_6C642CD0	7_2_6C642CD0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_6C641560	7_2_6C641560
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_00E07B08	8_2_00E07B08
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_0529C190	8_2_0529C190
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05295441	8_2_05295441
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_0529D630	8_2_0529D630
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD6F78	8_2_05AD6F78
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD3E20	8_2_05AD3E20
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05ADD1F1	8_2_05ADD1F1
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD0040	8_2_05AD0040
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD7B90	8_2_05AD7B90
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD900B	8_2_05AD900B
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD9018	8_2_05AD9018
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD9B68	8_2_05AD9B68
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD9B58	8_2_05AD9B58
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05AD72C0	8_2_05AD72C0
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_06B67658	8_2_06B67658
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_06B6DE41	8_2_06B6DE41
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_06B675C0	8_2_06B675C0
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_06B655E0	8_2_06B655E0

Dropped file seen in connection with other malware

Source: Joe Sandbox View

Dropped File: C:\ProgramData\MSTeamsSetup_c_l_.exe 73354811E3109E265821124A18B1B7D9FD3DD1207BB46C18937D250C6AB46DEC

Found potential string decryption / allocating functions

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: String function: 1105D1B0 appears 125 times
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: String function: 111429B0 appears 320 times
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: String function: 1115C743 appears 35 times
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: String function: 11029340 appears 574 times
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: String function: 00064585 appears 32 times
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: String function: 00064AF0 appears 54 times

PE file contains executable resources (Code or Archives)

Source: MSTeamsSetup_c_l_.exe.0.dr

Static PE information: Resource name: DATA type: Zip archive data, at least v2.0 to extract, compression method=deflate

PE file does not import any functions

Source: kbdax2.dll.0.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll.8.dr	Static PE information: No import functions for PE file found
Source: KBDBASH.DLL.0.dr	Static PE information: No import functions for PE file found
Source: KBDBGPH1.DLL.0.dr	Static PE information: No import functions for PE file found
Source: KBDA3.DLL.0.dr	Static PE information: No import functions for PE file found
Source: KBDAZE.DLL.0.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll0.8.dr	Static PE information: No import functions for PE file found
Source: kbd106n.dll.0.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll12.8.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll16.8.dr	Static PE information: No import functions for PE file found
Source: KBDA2.DLL.0.dr	Static PE information: No import functions for PE file found
Source: kbdarmph.dll.0.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll7.8.dr	Static PE information: No import functions for PE file found
Source: KBDBENE.DLL.0.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll8.8.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll5.8.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll15.8.dr	Static PE information: No import functions for PE file found
Source: KBDBLR.DLL.0.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll10.8.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll18.8.dr	Static PE information: No import functions for PE file found
Source: KBDAZEL.DLL.0.dr	Static PE information: No import functions for PE file found
Source: KBDARME.DLL.0.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll6.8.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll2.8.dr	Static PE information: No import functions for PE file found
Source: KBDBGPH.DLL.0.dr	Static PE information: No import functions for PE file found
Source: Microsoft.Teams.MeetingAddin.resources.dll14.8.dr	Static PE information: No import functions for PE file found

Sample file is different than original file name gathered from version info

Source: Teams.exe, 00000000.00000003.2088427922.000000000085B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbd106n.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2088427922.000000000085B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclient32.exe0 vs Teams.exe
Source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdaze.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2071938218.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdbash.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdazel.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdbgph.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdazel.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2073537360.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdazel.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdazel.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2073428564.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdaze.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdarme.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2071473492.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbd106n.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2071473492.000000000085C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameclient32.exe0 vs Teams.exe
Source: Teams.exe, 00000000.00000003.2071938218.0000000000879000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdbash.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamekbdarme.dllj% vs Teams.exe
Source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamepcicapi.dll0 vs Teams.exe
Source: Teams.exe, 00000000.00000000.2017284776.0000000000574000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameSetup.exe@ vs Teams.exe
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: OriginalFilename = vs Teams.exe
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Received fatal exception EXCEPTION_ACCESS_VIOLATIONEXCEPTION_ARRAY_BOUNDS_EXCEEDEDEXCEPTION_BREAKPOINTEXCEPTION_DATATYPE_MISALIGNMENTEXCEPTION_FLT_DENORMAL_OPERANDEXCEPTION_FLT_DIVIDE_BY_ZEROEXCEPTION_FLT_INEXACT_RESULTEXCEPTION_FLT_INVALID_OPERATIONEXCEPTION_FLT_OVERFLOWEXCEPTION_FLT_STACK_CHECKEXCEPTION_FLT_UNDERFLOWEXCEPTION_ILLEGAL_INSTRUCTIONEXCEPTION_IN_PAGE_ERROREXCEPTION_INT_DIVIDE_BY_ZEROEXCEPTION_INT_OVERFLOWEXCEPTION_INVALID_DISPOSITIONEXCEPTION_NONCONTINUABLE_EXCEPTIONEXCEPTION_PRIV_INSTRUCTIONEXCEPTION_SINGLE_STEPEXCEPTION_STACK_OVERFLOW%ls;%ls [0x(No symbol) [0x../../base/file_version_info_win.ccCreateFileVersionInfoWinCompanyNameCompanyShortNameInternalNameProductShortNameProductVersionFileDescriptionFileVersionOriginalFilenameSpecialBuild\StringFileInfo\%04x%04x\%ls\VarFileInfo\Translation\../../base/files/file_path_watcher_win.ccUpdateWatchDestroyWatchSetupWatchHandleOnObjectSignaled../../base/files/file_util_win.ccMakeAbsoluteFilePathDeleteFileAfterRebootReplaceFileWDirectoryExistsC:\CreateAndOpenTemporaryFileInDirwb+CreateTemporaryDirInDirCreateNewTempDirectoryCreateDirectoryAndGetErrorCreateFile failed for path Writing file Only wrote out of byte(s) to GetCurrentDirectoryWSetCurrentDirectoryWGetMaximumPathComponentLengthMoveUnsafeCopyAndDeleteDirectoryWindows.FileDeleteLastRetryError vs Teams.exe

Uses 32bit PE files

Source: Teams.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: classification engine

Classification label: mal51.troj.spyw.evad.winEXE@23/648@0/11

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_110590F0 GetLastError,FormatMessageA,LocalFree,

7_2_110590F0

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00051955 LookupPrivilegeValueW,GetCurrentProcess,OpenProcessToken,AdjustTokenPrivileges,CloseHandle,ExitWindowsEx,	5_2_00051955
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1109C360 AdjustTokenPrivileges,CloseHandle,	7_2_1109C360
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1109C2D0 GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,	7_2_1109C2D0

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_00056509 __EH_prolog3_GS,CoCreateInstance,VariantInit,IUnknown_QueryInterface_Proxy,VariantClear,VariantClear,

5_2_00056509

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_00056777 __EH_prolog3_GS,IUnknown_QueryInterface_Proxy,SysFreeString,VariantClear,VariantClear,VariantClear,VariantClear,SysAllocString,SHGetFolderPathW,CreateDirectoryW,GetLastError,FreeResource,

5_2_00056777

Source: C:\Users\user\Desktop\Teams.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ka[1].zip

Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Mutant created: \Sessions\1\BaseNamedObjects\Global\.net memory cache 4.0
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Mutant created: NULL
Source: C:\Users\user\Desktop\Teams.exe	Mutant created: \Sessions\1\BaseNamedObjects\gdfhdh5hbdtbdthjef4bh5eherfgerhe5hgrgf
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7128:120:WilError_03

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File created: C:\Users\user\AppData\Local\Temp\.squirrel-lock-7E50F52EC714C8319D0A96EF1BA7B246C79A298B

Jump to behavior

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Command line argument: kernel32.dll	5_2_0005E7E8
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Command line argument: --checkInstall	5_2_0005E7E8
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Command line argument: --allUsers	5_2_0005E7E8

Source: Teams.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\Teams.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Teams.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File read: C:\Windows\System32\drivers\etc\hosts	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File read: C:\Windows\System32\drivers\etc\hosts
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File read: C:\Windows\System32\drivers\etc\hosts

Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: CREATE TABLE cookies(creation_utc INTEGER NOT NULL,host_key TEXT NOT NULL,top_frame_site_key TEXT NOT NULL,name TEXT NOT NULL,value TEXT NOT NULL,encrypted_value BLOB NOT NULL,path TEXT NOT NULL,expires_utc INTEGER NOT NULL,is_secure INTEGER NOT NULL,is_httponly INTEGER NOT NULL,last_access_utc INTEGER NOT NULL,has_expires INTEGER NOT NULL,is_persistent INTEGER NOT NULL,priority INTEGER NOT NULL,samesite INTEGER NOT NULL,source_scheme INTEGER NOT NULL,source_port INTEGER NOT NULL,is_same_party INTEGER NOT NULL);
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);

Source: Teams.exe

ReversingLabs: Detection: 25%

Source: MSTeamsSetup_c_l_.exe	String found in binary or memory: Setup version is newer, re-installing Teams from the machine-wide installer...
Source: MSTeamsSetup_c_l_.exe	String found in binary or memory: "%s" --install . %s %s

Source: unknown	Process created: C:\Users\user\Desktop\Teams.exe "C:\Users\user\Desktop\Teams.exe"
Source: C:\Users\user\Desktop\Teams.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST
Source: C:\Users\user\Desktop\Teams.exe	Process created: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe C:\Users\user\AppData\Roaming\CSCOClient\client32.exe
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Teams.exe	Process created: C:\ProgramData\MSTeamsSetup_c_l_.exe C:\ProgramData\MSTeamsSetup_c_l_.exe
Source: unknown	Process created: C:\ProgramData\MSTeamsSetup_c_l_.exe "C:\ProgramData\MSTeamsSetup_c_l_.exe" --rerunningWithoutUAC
Source: unknown	Process created: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe C:\Users\user\AppData\Roaming\CSCOClient\client32.exe
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Process created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe "C:\Users\user\AppData\Local\SquirrelTemp\Update.exe" --install . --rerunningWithoutUAC --exeName=MSTeamsSetup_c_l_.exe --bootstrapperMode
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe" --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-install 1.7.00.15969
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-firstrun
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll"
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll"
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\SysWOW64\regsvr32.exe" /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll"
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Source: C:\Users\user\Desktop\Teams.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Process created: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Process created: C:\ProgramData\MSTeamsSetup_c_l_.exe C:\ProgramData\MSTeamsSetup_c_l_.exe	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Process created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe "C:\Users\user\AppData\Local\SquirrelTemp\Update.exe" --install . --rerunningWithoutUAC --exeName=MSTeamsSetup_c_l_.exe --bootstrapperMode	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Process created: C:\Windows\System32\regsvr32.exe /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll"

Source: C:\Users\user\Desktop\Teams.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Teams.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: pcicl32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: pcichek.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: pcicapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Section loaded: msvcr100.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: d3d9.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: d3d10warp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dataexchange.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: d3d11.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dcomp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dxgi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: resourcepolicyclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: dxcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: msctfui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: d3dcompiler_47.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Section loaded: explorerframe.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: msvcp140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: rasapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: rasman.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: rtutils.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: ffmpeg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: uiautomationcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dbghelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msimg32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dhcpcsvc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dbgcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: kbdus.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msvcp140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: credui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: vcruntime140_1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: vcruntime140.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: duser.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: atlthunk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dhcpcsvc6.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: windows.ui.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: windowmanagementapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: inputhost.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: winsta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: mscms.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: coloradapterclient.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: mmdevapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: devobj.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: cryptnet.dll	Jump to behavior
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: mscoree.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: msvcp140.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: vcruntime140_1.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\regsvr32.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: apphelp.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: aclayers.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: sfc_os.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: mscoree.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: msvcp140.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: vcruntime140.dll
Source: C:\Windows\SysWOW64\regsvr32.exe	Section loaded: vcruntime140.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dxgi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: mf.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: mfplat.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: rtworkq.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msmpeg2vdec.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: mfperfhelper.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: cryptsp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dxva2.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msvproc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: ffmpeg.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: uiautomationcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dbghelp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msimg32.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: winhttp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dhcpcsvc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dbgcore.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: msasn1.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: powrprof.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: umpdc.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: mswsock.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: kbdus.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: nlaapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: rasadhlp.dll
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Section loaded: fwpuclnt.dll

Source: C:\Users\user\Desktop\Teams.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\Teams.exe

File written: C:\Users\user\AppData\Roaming\CSCOClient\client32.ini

Jump to behavior

Found graphical window changes (likely an installer)

Source: Window Recorder

Window detected: More than 3 window changes detected

Uses Microsoft Silverlight

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

Checks if Microsoft Office is installed

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Teams

Jump to behavior

PE / OLE file has a valid certificate

Source: Teams.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: Teams.exe

Static file information: File size 2010032 > 1048576

Uses new MSVCR Dlls

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

File opened: C:\Windows\SysWOW64\MSVCR100.dll

Jump to behavior

PE file contains a mix of data directories often seen in goodware

Source: Teams.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: Teams.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: Teams.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: Teams.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Teams.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: Teams.exe	Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT

PE file contains a debug data directory

Source: Teams.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Binary contains paths to debug symbols

Source:	Binary string: E:\nsmsrc\nsm\1210\1210f\client32\Release\PCICL32.pdb source: client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: netstandard.pdb.mdb source: Update.exe, 00000008.00000002.3517726832.00000000042E3000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3517726832.0000000004752000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000000.2136346830.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, Squirrel.exe, 0000000C.00000000.3381098189.0000000000B5F000.00000002.00000001.01000000.00000012.sdmp
Source:	Binary string: kbdbgph.pdbGCTL source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdazel.pdbGCTL source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdbash.pdbGCTL source: Teams.exe, 00000000.00000003.2071938218.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071938218.0000000000879000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdbash.pdb source: Teams.exe, 00000000.00000003.2071938218.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071938218.0000000000879000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\BuildAgent\work\che-trunk-git-yandex-ru\win\YandexDiskUploaderSetup\Release\YandexDiskSetup.pdb source: Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp
Source:	Binary string: D:\a\_work\1\s\src\Setup\bin\Release\Setup.pdb/ source: MSTeamsSetup_c_l_.exe, 00000005.00000000.2132512592.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000006.00000002.3550890669.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000006.00000000.2133601797.0000000000086000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: D:\a\_work\1\s\src\Setup\bin\Release\Setup.pdb source: MSTeamsSetup_c_l_.exe, 00000005.00000000.2132512592.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000006.00000002.3550890669.0000000000086000.00000002.00000001.01000000.0000000A.sdmp, MSTeamsSetup_c_l_.exe, 00000006.00000000.2133601797.0000000000086000.00000002.00000001.01000000.0000000A.sdmp
Source:	Binary string: kbdaze.pdbGCTL source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073428564.0000000000872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdaze.pdb source: Teams.exe, 00000000.00000003.2073428564.0000000000879000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073428564.0000000000872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbd106n.pdbGCTL source: Teams.exe, 00000000.00000003.2088427922.000000000085B000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071473492.000000000085C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdazel.pdb source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088413950.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2073537360.0000000000879000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdarme.pdbGCTL source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdbgph.pdb source: Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbd106n.pdb source: Teams.exe, 00000000.00000003.2088427922.000000000085B000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071473492.000000000085C000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: kbdarme.pdb source: Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\nsmsrc\nsm\1280\1280\ctl32\release_unicode\pcicapi.pdb source: Teams.exe, 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp, client32.exe, 00000007.00000002.2142416380.000000006C645000.00000002.00000001.01000000.00000009.sdmp

PE file contains a valid data directory to section mapping

Source: Teams.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: Teams.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: Teams.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: Teams.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: Teams.exe	Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation

Binary contains a suspicious time stamp

Source: kbdarmph.dll.0.dr

Static PE information: 0xDE882D5B [Thu Apr 22 10:00:59 2088 UTC]

Contains functionality to dynamically determine API calls

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_0005E7E8 LoadLibraryW,GetProcAddress,lstrlenW,lstrlenW,CoInitialize,InitCommonControlsEx,MessageBoxW,GetModuleHandleW,GetModuleFileNameW,lstrlenW,CoUninitialize,

5_2_0005E7E8

PE file contains sections with non-standard names

Source: PCICL32.DLL.0.dr	Static PE information: section name: .hhshare
Source: WebView2Loader.dll.8.dr	Static PE information: section name: .00cfg
Source: WebView2Loader.dll.8.dr	Static PE information: section name: .voltbl
Source: adal2-meetingaddin.dll.8.dr	Static PE information: section name: .didat

Registers a DLL

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll"

Uses code obfuscation techniques (call, push, ret)

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0006451A push ecx; ret	5_2_0006452D
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00064B36 push ecx; ret	5_2_00064B49
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1102D36A push eax; ret	7_2_1102D36D
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1116B3B5 push ecx; ret	7_2_1116B3C8
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_111662A9 push ecx; ret	7_2_111662BC
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_6C644485 push ecx; ret	7_2_6C644498
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_00EEC200 push eax; mov dword ptr [esp], edx	8_2_00EEC214
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_052943AF push esp; retn 051Ah	8_2_05294771
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05296D6F push esp; iretd	8_2_05296D79
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_05295EAA push esp; iretd	8_2_05295EB1
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_06B66D63 push edx; ret	8_2_06B66D73
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_06B6D8A0 push eax; mov dword ptr [esp], ecx	8_2_06B6D8B4
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_078D8E80 pushfd ; iretd	8_2_078D8E89
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_078D4EFB pushfd ; iretd	8_2_078D4F01
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Code function: 8_2_078D8E50 pushad ; iretd	8_2_078D8E59

Persistence and Installation Behavior

Contains functionality to download and launch executables

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

5_2_0005136F

Drops PE files

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\SlimCV.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\kbdax2.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\pcicapi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@msteams\package-utils\build\Release\package-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keyboard-layout\build\Release\keyboard-layout-manager.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmPal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\OneAuth.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@skype\call-manager\build\Release\call_manager.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\modern-osutils\build\Release\modern-osutils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\fasttext-languagedetector\build\Release\fastText-languagedetector.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\AudioCapture.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\msvcp140.dll	Jump to dropped file
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	File created: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\AddinInstaller.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\office-int-win\build\Release\office-int-win.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\adal34-win\build\Release\adal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AuthLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDBASH.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.AuthLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Applications.Telemetry.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\AddinInstaller.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\d3dcompiler_47.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDA3.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\adal2-meetingaddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\OneAuth.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\kbd106n.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmMediaManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\electron-windows-interactive-notifications\build\Release\InteractiveNotifications.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDBENE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\media-hid\build\Release\media-hid.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmCodecs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\adal2-meetingaddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\ProgramData\MSTeamsSetup_c_l_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDAZEL.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\TeamsIconSet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\vcomp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDAZE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\adal2-meetingaddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\ucrtbase.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\vcruntime140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDBGPH1.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\ffmpeg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.MeetingAddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\slimcore.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\OneAuth.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keytar4\build\Release\keytar.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDA2.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmControl.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDBLR.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\skypert.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDARME.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\registry-utils\build\Release\registry-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\msft-wam\build\Release\wam.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\adal2-meetingaddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\KBDBGPH.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\AddinInstaller.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\vdibridge.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Applications.Telemetry.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\onnxruntime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\m365-browser\build\Release\m365-browser.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\oneauth\lib\oneauth.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\AddinInstaller.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AuthLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RTMPLTFM.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\OneAuth.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\native-utils\build\Release\native-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.AuthLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\adal34-win\build\Release\adal-win.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\vcruntime140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\sharing-indicator.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.MeetingAddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\PCICL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\vccorlib140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\electron-windows-interactive-notifications\build\Release\notifications_bindings.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\packages\RELEASES.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\ssScreenVVS2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\concrt140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\Update.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	File created: C:\Users\user\AppData\Roaming\CSCOClient\kbdarmph.dll	Jump to dropped file

Drops PE files to the application program directory (C:\ProgramData)

Source: C:\Users\user\Desktop\Teams.exe

File created: C:\ProgramData\MSTeamsSetup_c_l_.exe

Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\oneauth\lib\oneauth.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\electron-windows-interactive-notifications\build\Release\notifications_bindings.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\registry-utils\build\Release\registry-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\vdibridge.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\sharing-indicator.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\slimcore.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\fasttext-languagedetector\build\Release\fastText-languagedetector.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@msteams\package-utils\build\Release\package-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@skype\call-manager\build\Release\call_manager.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\adal34-win\build\Release\adal-win.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keyboard-layout\build\Release\keyboard-layout-manager.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keytar4\build\Release\keytar.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\m365-browser\build\Release\m365-browser.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\media-hid\build\Release\media-hid.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\modern-osutils\build\Release\modern-osutils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\msft-wam\build\Release\wam.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\native-utils\build\Release\native-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\office-int-win\build\Release\office-int-win.node	Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	File created: C:\Users\user\AppData\Local\SquirrelTemp\SquirrelSetup.log			Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	File created: C:\Users\user\AppData\Local\Microsoft\Teams\current\SquirrelSetup.log			Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\Desktop\Teams.exe

Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST

Hooking and other Techniques for Hiding and Protection

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_110CA140 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CA140
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_110CA140 GetWindowRect,IsIconic,GetClientRect,GetSystemMetrics,GetSystemMetrics,GetSystemMetrics,IsIconic,GetWindowRect,SetWindowPos,	7_2_110CA140
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_110241E0 IsWindow,IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_110241E0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_110253E0 SetWindowPos,GetMenu,DrawMenuBar,GetMenu,DeleteMenu,UpdateWindow,IsIconic,SetTimer,KillTimer,	7_2_110253E0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_111572A0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_111572A0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_111572A0 IsIconic,ShowWindow,BringWindowToTop,IsWindow,IsIconic,ShowWindow,BringWindowToTop,	7_2_111572A0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_111576A0 SendMessageA,SendMessageA,ShowWindow,SendMessageA,IsIconic,IsZoomed,ShowWindow,GetDesktopWindow,TileWindows,	7_2_111576A0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11025830 IsIconic,BringWindowToTop,GetCurrentThreadId,	7_2_11025830
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11023B00 BringWindowToTop,SetWindowPos,SetWindowPos,SetWindowPos,GetWindowLongA,SetWindowLongA,GetDlgItem,EnableWindow,GetMenu,DeleteMenu,DrawMenuBar,SetWindowPos,IsIconic,UpdateWindow,SetTimer,KillTimer,	7_2_11023B00
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_110BFB00 IsIconic,ShowWindow,BringWindowToTop,GetCurrentThreadId,	7_2_110BFB00
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1110FBE0 IsIconic,GetTickCount,	7_2_1110FBE0

Extensive use of GetProcAddress (often used to hide API calls)

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_00063140 GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

5_2_00063140

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process information set: NOGPFAULTERRORBOX \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Contain functionality to detect virtual machines

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: SOFTWARE\VMware, Inc.\VMware VDM SOFTWARE\VMware, Inc.\VMware VDM

5_2_0005A1C0

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Memory allocated: EE0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Memory allocated: 2CC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Memory allocated: 29D0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Memory allocated: 2EA0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Memory allocated: 3070000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Memory allocated: 5070000 memory reserve \| memory write watch	Jump to behavior

Contains long sleeps (>= 3 min)

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Window / User API: threadDelayed 2864	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Window / User API: threadDelayed 6810	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Window / User API: threadDelayed 9395	Jump to behavior

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\SlimCV.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-timezone-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-console-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\kbdax2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@msteams\package-utils\build\Release\package-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keyboard-layout\build\Release\keyboard-layout-manager.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmPal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\OneAuth.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@skype\call-manager\build\Release\call_manager.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\modern-osutils\build\Release\modern-osutils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-convert-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\fasttext-languagedetector\build\Release\fastText-languagedetector.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\AudioCapture.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\AddinInstaller.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-errorhandling-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\office-int-win\build\Release\office-int-win.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-math-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\adal34-win\build\Release\adal.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AuthLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-console-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDBASH.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.AuthLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Applications.Telemetry.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\AddinInstaller.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDA3.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\adal2-meetingaddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-localization-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\OneAuth.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-sysinfo-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-filesystem-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\kbd106n.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmMediaManager.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-libraryloader-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\vulkan-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-rtlsupport-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\electron-windows-interactive-notifications\build\Release\InteractiveNotifications.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\runtimes\win-x86\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDBENE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\media-hid\build\Release\media-hid.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processthreads-l1-1-1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-runtime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmCodecs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\adal2-meetingaddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-debug-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDAZEL.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\TeamsIconSet.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\vcomp140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-stdio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDAZE.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\adal2-meetingaddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-time-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-utility-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDBGPH1.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-memory-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\remcmdstub.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.MeetingAddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\slimcore.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.Core.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_1.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\OneAuth.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keytar4\build\Release\keytar.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDA2.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmControl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\runtimes\win-x64\native\WebView2Loader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\skypert.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDBLR.DLL	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDARME.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\registry-utils\build\Release\registry-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-util-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-synch-l1-2-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_atomic_wait.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\msft-wam\build\Release\wam.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-heap-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processthreads-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\adal2-meetingaddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-string-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_codecvt_ids.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-multibyte-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processenvironment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.Diagnostics.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\KBDBGPH.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-namedpipe-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\AddinInstaller.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\vdibridge.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-datetime-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Applications.Telemetry.Windows.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-process-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l2-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\onnxruntime.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\libEGL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\m365-browser\build\Release\m365-browser.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-synch-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-handle-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\oneauth\lib\oneauth.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\AddinInstaller.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AuthLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RTMPLTFM.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\OneAuth.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-conio-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-environment-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\native-utils\build\Release\native-utils.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.AuthLib.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\adal34-win\build\Release\adal-win.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-profile-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\System.IdentityModel.Tokens.Jwt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\TCCTL32.DLL	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.Wpf.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.JsonWebTokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\sharing-indicator.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.MeetingAddin.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-locale-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\System.Net.Http.Formatting.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\vk_swiftshader.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Newtonsoft.Json.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-private-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.Tokens.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\vccorlib140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\libGLESv2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\electron-windows-interactive-notifications\build\Release\notifications_bindings.node	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\packages\RELEASES.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\ssScreenVVS2.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-interlocked-l1-1-0.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.WinForms.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\concrt140.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.Logging.dll	Jump to dropped file
Source: C:\Users\user\Desktop\Teams.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Roaming\CSCOClient\kbdarmph.dll	Jump to dropped file

Found evasive API chain checking for process token information

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Check user administrative privileges: GetTokenInformation,DecisionNodes

graph_5-25599

Found large amount of non-executed APIs

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

API coverage: 6.7 %

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe TID: 6056	Thread sleep time: -6456360425798339s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe TID: 4676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe TID: 4676	Thread sleep time: -922337203685477s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe TID: 1400	Thread sleep time: -25825441703193356s >= -30000s	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe TID: 1220	Thread sleep count: 126 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe TID: 5068	Thread sleep count: 242 > 30	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe TID: 2180	Thread sleep count: 9395 > 30	Jump to behavior

Queries keyboard layouts

Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809			Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Key opened: HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Keyboard Layouts\d0010809

Queries sensitive BIOS Information (via WMI, Win32_Bios & Win32_BaseBoard, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Teams.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS
Source: C:\Users\user\Desktop\Teams.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_BIOS

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Users\user\Desktop\Teams.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\Desktop\Teams.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystem
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	WMI Queries: IWbemServices::CreateInstanceEnum - root\cimv2 : Win32_ComputerSystemProduct

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_0007C0A5 FindFirstFileExW,	5_2_0007C0A5
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00056982 SHGetFolderPathW,CreateDirectoryW,GetLastError,SHGetFolderPathW,GetUserNameW,GetLastError,CreateDirectoryW,GetLastError,FindResourceW,LoadResource,SizeofResource,LockResource,DeleteFileW,FreeResource,GetFileAttributesW,GetModuleHandleW,GetModuleFileNameW,PathFileExistsW,CopyFileW,FindFirstFileW,GetLastError,FindClose,CreateProcessW,WaitForSingleObject,GetExitCodeProcess,DeleteFileW,CloseHandle,CloseHandle,FreeResource,	5_2_00056982
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1110C060 GetLocalTime,wsprintfA,FindFirstFileA,FindNextFileA,FindClose,wsprintfA,ExpandEnvironmentStringsA,CreateFileA,timeBeginPeriod,GetLocalTime,timeGetTime,WriteFile,	7_2_1110C060
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1102D212 GetModuleFileNameA,GetFileAttributesA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D212
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1102D516 GetModuleFileNameA,GetFileAttributesA,FindFirstFileA,FindNextFileA,FindNextFileA,FindClose,ExitWindowsEx,ExitWindowsEx,Sleep,ExitWindowsEx,Sleep,ExitProcess,	7_2_1102D516
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11123B60 GetVersionExA,GetTempPathA,GetModuleFileNameA,_strrchr,CreateFileA,CreateFileA,WriteFile,CloseHandle,CloseHandle,CreateFileA,GetCurrentProcessId,wsprintfA,CreateProcessA,CloseHandle,CloseHandle,CloseHandle,CreateProcessA,DeleteFileA,Sleep,WaitForSingleObject,CloseHandle,GetCurrentProcess,RemoveDirectoryA,GetLastError,ExitProcess,FindNextFileA,FindClose,FindFirstFileA,GetCurrentProcess,GetCurrentProcess,DuplicateHandle,GetModuleFileNameA,_strrchr,_memmove,GetThreadContext,VirtualProtectEx,WriteProcessMemory,FlushInstructionCache,SetThreadContext,ResumeThread,CloseHandle,CloseHandle,	7_2_11123B60

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Thread delayed: delay time: 922337203685477	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Thread delayed: delay time: 922337203685477	Jump to behavior

Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Teams\current	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Teams	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData\Local\Microsoft	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VMware Virtual Webcam
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VMware Fusion 4 has corrupt rendering with Win Vista+
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Access-Control-Allow-Credentials: trueNet.RedirectChainLengthurl_chainload_state_paramdelegate_blocked_byhas_uploadis_pendingDelegateNet.URLRequest.ReferrerPolicyForRequest.SameOriginNet.URLRequest.ReferrerHasInformativePath.SameOriginNet.URLRequest.ReferrerPolicyForRequest.CrossOriginNet.URLRequest.ReferrerHasInformativePath.CrossOrigin../../net/url_request/url_request_job.ccOnDonenum_failuresrelease_after_msThrottling.RequestThrottled../../net/base/network_interfaces_win.ccWlanApiwlanapi.dllWlanQueryInterfaceWlanSetInterfaceVMnetGetAdaptersAddresses failed: 8<
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VMnet
Source: MSTeamsSetup_c_l_.exe, 00000006.00000000.2133601797.0000000000086000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: vmware
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VMware, Inc.
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VMware Inc.
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FDFBB000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: eb1a:2860eb1a:28201ce6:282012ab:03801943:22530c45:64d00c45:64d21bcf:298504ca:704704ca:704804f2:b3ed04f2:b3ca05c8:035d05c8:036904ca:709513d3:52570bda:57f20fd9:0066VMware Virtual WebcamMedia.VideoCapture.BlacklistedDeviceGoogle Camera AdapterIP Camera [JPEG/MJPEG]CyberLink Webcam SplitterEpocCam../../media/capture/video/video_capture_metrics.ccDevice supports Media.VideoCapture.Device.SupportedPixelFormatMedia.VideoCapture.Device.SupportedResolution
Source: MSTeamsSetup_c_l_.exe, 00000006.00000000.2133601797.0000000000086000.00000002.00000001.01000000.0000000A.sdmp	Binary or memory string: F: Unknown exceptionstring too longSOFTWARE\Citrix\PortICAPorticaV2SOFTWARE\VMware, Inc.\VMware VDMAgentInstallPathSOFTWARE\Microsoft\TeamsIsWVDEnvironmentcitrix-xen-desktopcitrix-xen-appvmwarewvdnoneLOCALAPPDATA\SquirrelTemp\SquirrelSetup.log%Y-%m-%d %H:%M:%S> Setup: 1
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Gearway Electronics (Dong Guan) Co., Ltd.VMware Inc.Olimex Ltd.
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: Qemu Audio Device
Source: MSTeamsSetup_c_l_.exe	Binary or memory string: SOFTWARE\VMware, Inc.\VMware VDM
Source: Teams.exe, 0000000E.00000000.3446098723.00007FF6FE2C9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: lgnW2/4/PEZB31jiVg88O8EckzXZOFKs7sjsLjBOlDW0JB9LeGna8gI4zJVSk/BwJVmcIGfE
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: VMware can crash with older drivers and WebGL content
Source: Update.exe, 00000008.00000002.3528892586.0000000005BE9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll::

Anti Debugging

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_00064760 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,

5_2_00064760

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_11143CB0 GetLastError,wsprintfA,OutputDebugStringA,OutputDebugStringA,OutputDebugStringA,SetLastError,GetKeyState,

7_2_11143CB0

Contains functionality to dynamically determine API calls

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_0005E7E8 LoadLibraryW,GetProcAddress,lstrlenW,lstrlenW,CoInitialize,InitCommonControlsEx,MessageBoxW,GetModuleHandleW,GetModuleFileNameW,lstrlenW,CoUninitialize,

5_2_0005E7E8

Contains functionality to read the PEB

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_00070CC3 mov eax, dword ptr fs:[00000030h]

5_2_00070CC3

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_0007CFF0 GetProcessHeap,

5_2_0007CFF0

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00064760 IsProcessorFeaturePresent,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00064760
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_000648F3 SetUnhandledExceptionFilter,	5_2_000648F3
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00068A5F IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,	5_2_00068A5F
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: 5_2_00063ADC SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	5_2_00063ADC
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_1115E061 IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,	7_2_1115E061
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11030CCF SetUnhandledExceptionFilter,	7_2_11030CCF
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_11091EB0 _NSMFindClass@12,SetUnhandledExceptionFilter,	7_2_11091EB0
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: 7_2_6C643C17 IsDebuggerPresent,_crt_debugger_hook,SetUnhandledExceptionFilter,UnhandledExceptionFilter,_crt_debugger_hook,GetCurrentProcess,TerminateProcess,	7_2_6C643C17

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion

Contains functionality to enumerate process and check for explorer.exe or svchost.exe (often used for thread injection)

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: GetWindowRect,GetWindowLongA,GetClassNameA,GetWindowThreadProcessId,OpenProcess,CloseHandle,FreeLibrary, \Explorer.exe

7_2_1102FDD0

Contains functionality to simulate keystroke presses

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_1110F9F0 GetKeyState,DeviceIoControl,keybd_event,

7_2_1110F9F0

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\Teams.exe	Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8	Jump to behavior

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "c:\users\user\appdata\local\microsoft\teams\current\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\microsoft\teams" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1724 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "c:\users\user\appdata\local\microsoft\teams\current\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\microsoft\teams" --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "c:\users\user\appdata\local\microsoft\teams\current\teams.exe" --type=gpu-process --user-data-dir="c:\users\user\appdata\roaming\microsoft\teams" --gpu-preferences=uaaaaaaaaadgaaayaaaaaaaaaaaaaaaaaabgaaaaaaawaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaegaaaaaaaaasaaaaaaaaaayaaaaagaaabaaaaaaaaaagaaaaaaaaaaqaaaaaaaaaaaaaaaoaaaaeaaaaaaaaaabaaaadgaaaagaaaaaaaaacaaaaaaaaaa= --mojo-platform-channel-handle=1724 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:2	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Process created: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe "c:\users\user\appdata\local\microsoft\teams\current\teams.exe" --type=utility --utility-sub-type=network.mojom.networkservice --lang=en-gb --service-sandbox-type=none --user-data-dir="c:\users\user\appdata\roaming\microsoft\teams" --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=sparerendererforsiteperprocess,winretrievesuggestionsonlyondemand /prefetch:8	Jump to behavior

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_1109D020 LocalAlloc,InitializeSecurityDescriptor,SetSecurityDescriptorDacl,GetVersionExA,GetSecurityDescriptorSacl,SetSecurityDescriptorSacl,FreeLibrary,CreateFileMappingA,GetLastError,LocalFree,LocalFree,LocalFree,GetLastError,MapViewOfFile,LocalFree,LocalFree,LocalFree,GetModuleFileNameA,GetModuleFileNameA,LocalFree,LocalFree,LocalFree,GetTickCount,GetCurrentProcessId,GetModuleFileNameA,CreateEventA,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,CreateEventA,GetLastError,GetLastError,GetLastError,LocalFree,LocalFree,LocalFree,GetCurrentThreadId,CreateThread,ResetEvent,ResetEvent,ResetEvent,ResetEvent,SetEvent,

7_2_1109D020

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_11093520 AllocateAndInitializeSid,EqualSid,

7_2_11093520

Source: client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Progman\|
Source: client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Shell_TrayWndunhandled plugin data, id=%d
Source: client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Shell_TrayWnd
Source: client32.exe, client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	Binary or memory string: Progman
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FD6D4000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: ../../electron/shell/browser/ui/views/electron_views_delegate_win.ccGetAppbarAutohideEdgesShell_TrayWnd
Source: Teams.exe, 0000000D.00000000.3410252476.00007FF6FE2C9000.00000002.00000001.01000000.00000013.sdmp, Teams.exe, 0000000E.00000000.3446098723.00007FF6FE2C9000.00000002.00000001.01000000.00000013.sdmp	Binary or memory string: ?@../../third_party/webrtc/modules/desktop_capture/win/cursor.ccCreateMouseCursorFromHCursorUnable to get cursor icon info. Error = Unable to get bitmap info. Error = Unable to get bitmap bits. Error = DwmIsCompositionEnabledDwmGetWindowAttribute../../third_party/webrtc/modules/desktop_capture/win/window_capture_utils.ccFail to create instance of VirtualDesktopManagerChrome_WidgetWin_Progman

Language, Device and Operating System Detection

Contains functionality to query CPU information (cpuid)

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_00064949 cpuid

5_2_00064949

Contains functionality to query locales information (e.g. system language)

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: GetLocaleInfoW,	5_2_0007F210
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	5_2_0007F339
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: GetLocaleInfoW,	5_2_0007F440
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: GetLocaleInfoW,	5_2_000754CF
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoW,GetLocaleInfoW,	5_2_0007F50D
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: IsValidCodePage,_wcschr,_wcschr,GetLocaleInfoW,	5_2_0007EBC2
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: EnumSystemLocalesW,	5_2_0007EE49
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: EnumSystemLocalesW,	5_2_0007EE94
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: EnumSystemLocalesW,	5_2_0007EF2F
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,	5_2_0007EFC0
Source: C:\ProgramData\MSTeamsSetup_c_l_.exe	Code function: EnumSystemLocalesW,	5_2_00074FE6
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: _strlen,_strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_11170029
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: _strlen,_GetPrimaryLen,EnumSystemLocalesA,	7_2_11170090
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: __getptd,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_strlen,EnumSystemLocalesA,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,GetLocaleInfoA,_strcpy_s,GetLocaleInfoA,GetLocaleInfoA,__itow_s,	7_2_111700CC
Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_1116FBA1

Queries information about the installed CPU (vendor, model number etc)

Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe

Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Jump to behavior

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Web\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Web.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\downloading.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationTypes\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationTypes.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\UIAutomationProvider\v4.0_4.0.0.0__31bf3856ad364e35\UIAutomationProvider.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\downloading.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\background.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\background.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\background.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe	Queries volume information: C:\Users\user\AppData\Local\SquirrelTemp\background.gif VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Caching\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Runtime.Caching.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Teams\Update.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\ VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData\Local VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Teams VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Teams\current VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Teams VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Users\user\AppData\Roaming\Microsoft\Teams VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Windows\System32\spool\drivers\color\sRGB Color Space Profile.icm VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation
Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe	Queries volume information: C:\Windows\System32\drivers\etc\hosts VolumeInformation

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_00075539 GetSystemTimeAsFileTime,

5_2_00075539

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_0005248F GetModuleHandleW,GetModuleFileNameW,SHGetFolderPathW,SHGetFolderPathW,GetUserNameW,

5_2_0005248F

Source: C:\ProgramData\MSTeamsSetup_c_l_.exe

Code function: 5_2_000760DE _free,_free,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,_free,

5_2_000760DE

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

7_2_1109D020

Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Remote Access Functionality

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Code function: 7_2_6C642A30 CapiListen,memset,

7_2_6C642A30

Yara detected NetSupport remote tool

Source: Yara match	File source: 7.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.0.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.6c640000.3.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.111b3150.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.client32.exe.11000000.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Teams.exe PID: 6036, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 5244, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: client32.exe PID: 1272, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\CSCOClient\pcicapi.dll, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\CSCOClient\PCICL32.DLL, type: DROPPED
Source: Yara match	File source: C:\Users\user\AppData\Roaming\CSCOClient\AudioCapture.dll, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	1 Valid Accounts	2 Windows Management Instrumentation	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	21 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	2 Native API	1 DLL Search Order Hijacking	1 DLL Search Order Hijacking	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Screen Capture	1 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	13 Command and Scripting Interpreter	1 Valid Accounts	1 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	4 File and Directory Discovery	SMB/Windows Admin Shares	21 Input Capture	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	11 Access Token Manipulation	1 Timestomp	NTDS	75 System Information Discovery	Distributed Component Object Model	3 Clipboard Data	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	22 Process Injection	1 DLL Side-Loading	LSA Secrets	1 Query Registry	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	1 DLL Search Order Hijacking	Cached Domain Credentials	141 Security Software Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Masquerading	DCSync	1 Process Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Valid Accounts	Proc Filesystem	141 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	141 Virtualization/Sandbox Evasion	/etc/passwd and /etc/shadow	11 Application Window Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	11 Access Token Manipulation	Network Sniffing	1 System Owner/User Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	22 Process Injection	Input Capture	1 Remote System Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption
Gather Victim Org Information	DNS Server	Compromise Software Supply Chain	Windows Command Shell	Scheduled Task	Scheduled Task	1 Regsvr32	Keylogging	Process Discovery	Taint Shared Content	Screen Capture	DNS	Exfiltration Over Physical Medium	Resource Hijacking

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Teams.exe	25%	ReversingLabs	Win32.Trojan.Generic

Dropped Files

Source	Detection	Scanner
C:\ProgramData\MSTeamsSetup_c_l_.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\AddinInstaller.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.JsonWebTokens.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.Logging.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.Tokens.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AuthLib.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.Diagnostics.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.Core.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.WinForms.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.Wpf.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Newtonsoft.Json.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\OneAuth.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\System.IdentityModel.Tokens.Jwt.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\System.Net.Http.Formatting.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\adal2-meetingaddin.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\da-DK\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\de-DE\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\el-GR\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\en-GB\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\es-ES\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\es-MX\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\et-EE\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\he-IL\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\id-ID\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\is-IS\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\it-IT\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\msvcp140.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\runtimes\win-x64\native\WebView2Loader.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\th-TH\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll	0%	ReversingLabs

Source	Detection	Scanner	Label
http://www.symauth.com/cps0(	0%	URL Reputation	safe
http://defaultcontainer/lib/net45/resources/assets/Badge_2.pngd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/pt-PT/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
https://github.com/myuser/myrepo	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/tr.pakd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-crt-heap-l1-1-0.dll	0%	Avira URL Cloud	safe
http://geo.netsupportsoftware.com/location/loca.asp	0%	Avira URL Cloud	safe
http://disk.yandex.com.tr/download/YandexDiskSetupPack.exe/	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/tr.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.exe	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.pngd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/es-MX/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-core-console-l1-2-0.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-core-errorhandling-l1-1-0.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/vulkan-1.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-gl-es.json	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.shasumd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/20x20-dnd.png	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/Update.VisualElementsManifest.xml	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Newtonsoft.Json.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/Taskbar.png	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/msix/teams-app-icon-44.pngd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/runtimes/win-x64/native/We	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/pl-PL/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-ar-sa.json	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/msvcp140.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-ro-ro.jsond	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-nn-no.jsond	0%	Avira URL Cloud	safe
http://schemas.openxmlformats.or	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/he.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/kn.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/es-419.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/icudtl.datd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/hr.pakd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/sk-SK/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-fil-ph.jsond	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/Teams.exed	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/en-US.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-de-de.jsond	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/ca.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-core-errorhandling-l1-1-0.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/snapshot_blob.bind	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.pakd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-zh-cn.jsond	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/tlb/Uc.win32.tlbd	0%	Avira URL Cloud	safe
https://whispry.com/	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/nb-NO/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/v8_context_snapshot.bind	0%	Avira URL Cloud	safe
https://whispry.com/zl/kc.zip	100%	Avira URL Cloud	malware
http://defaultcontainer/lib/net45/resources/locales/locale-en-au.json	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/msvcp140_2.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-pseudo.json	0%	Avira URL Cloud	safe
http://www.symauth.com/rpa00	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/cm.slim	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-core-file-l1-2-0.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/Teams.nuspec	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/AddinInstaller.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/cm.slimd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/ro-RO/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/TeamsIconSet.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.png	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.xmld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/ro-RO/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-fi-fi.json	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/af.pakd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/nl-NL/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-core-file-l2-1-0.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/tr-TR/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/lv-LV/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/windows/TeamsLogo.contrast-white_scale-100.pngd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/Squirrel.exed	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/de.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/fa.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-core-interlocked-l1-1-0.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/Badge_7.png	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/cs-CZ/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/msix/teams-app-icon-150.targetsize-150_altform-un	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/libGLESv2.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.asar	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/m365-browser/build/Releas	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-core-debug-l1-1-0.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/qm.slim	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/gu.pak	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/20x20-available.png	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/es-MX/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/locales/ko.pak	0%	Avira URL Cloud	safe
https://yandex.com.tr/support/disk-desktop-windows/installation.html#dont-install	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-fr-fr.jsond	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/sharing-indi	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/api-ms-win-core-timezone-l1-1-0.dll	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/12x12-dnd.pngd	0%	Avira URL Cloud	safe
http://www.netsupportschool.com/tutor-assistant.asp11(	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.ftz	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.dlld	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/locales/locale-ro-ro.json	0%	Avira URL Cloud	safe
http://defaultcontainer/tempfiles/sample.txtd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/is-IS/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/assets/20x20-dnd.pngd	0%	Avira URL Cloud	safe
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/is-IS/Microsoft.Teams.Meet	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://defaultcontainer/lib/net45/locales/tr.pakd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/myuser/myrepo	Update.exe, 00000008.00000002.3517726832.00000000042E3000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3517726832.0000000004752000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000000.2136346830.0000000000692000.00000002.00000001.01000000.0000000B.sdmp, Squirrel.exe, 0000000C.00000000.3381098189.0000000000B5F000.00000002.00000001.01000000.00000012.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/tr.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.pngd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/pt-PT/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://geo.netsupportsoftware.com/location/loca.asp	client32.exe, client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/Badge_2.pngd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-crt-heap-l1-1-0.dll	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://disk.yandex.com.tr/download/YandexDiskSetupPack.exe/	Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.exe	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/vulkan-1.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-core-console-l1-2-0.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-core-errorhandling-l1-1-0.dll	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/es-MX/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/Newtonsoft.Json.dll	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/20x20-dnd.png	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-gl-es.json	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.shasumd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/Taskbar.png	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/Update.VisualElementsManifest.xml	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/msix/teams-app-icon-44.pngd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-ar-sa.json	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/msvcp140.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/runtimes/win-x64/native/We	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/pl-PL/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-nn-no.jsond	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-ro-ro.jsond	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://schemas.openxmlformats.or	Update.exe, 00000008.00000002.3512878472.00000000030D6000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/kn.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/he.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/es-419.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/hr.pakd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/icudtl.datd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/sk-SK/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-fil-ph.jsond	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/Teams.exed	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-de-de.jsond	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/en-US.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/ca.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/snapshot_blob.bind	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://127.0.0.1	client32.exe, 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp, Teams.exe, 0000000D.00000000.3410252476.00007FF6FE2C9000.00000002.00000001.01000000.00000013.sdmp, Teams.exe, 0000000E.00000000.3446098723.00007FF6FE2C9000.00000002.00000001.01000000.00000013.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-core-errorhandling-l1-1-0.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/tlb/Uc.win32.tlbd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.pakd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-zh-cn.jsond	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/cps0(	Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://whispry.com/	Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.0000000000820000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/v8_context_snapshot.bind	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-pseudo.json	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/nb-NO/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/msvcp140_2.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://whispry.com/zl/kc.zip	Teams.exe, 00000000.00000003.2072025695.0000000000817000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2072147458.0000000000811000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071966732.0000000000820000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2071966732.0000000000810000.00000004.00000020.00020000.00000000.sdmp, Teams.exe, 00000000.00000003.2088427922.000000000080A000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-en-au.json	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/cm.slim	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.symauth.com/rpa00	Teams.exe, 00000000.00000003.2108491082.0000000000872000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-core-file-l1-2-0.dll	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/Teams.nuspec	Update.exe, 00000008.00000002.3512878472.00000000030D6000.00000004.00000800.00020000.00000000.sdmp, Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/AddinInstaller.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/ro-RO/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/ro-RO/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/cm.slimd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-fi-fi.json	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/af.pakd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/TeamsIconSet.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.png	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.xmld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/nl-NL/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-core-file-l2-1-0.dll	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/lv-LV/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/tr-TR/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/windows/TeamsLogo.contrast-white_scale-100.pngd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/de.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/Squirrel.exed	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-core-interlocked-l1-1-0.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/fa.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/Badge_7.png	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.asar	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/qm.slim	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/msix/teams-app-icon-150.targetsize-150_altform-un	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/cs-CZ/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/libGLESv2.dll	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-core-debug-l1-1-0.dll	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/m365-browser/build/Releas	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/gu.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/20x20-available.png	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-fr-fr.jsond	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/es-MX/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/locales/ko.pak	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://yandex.com.tr/support/disk-desktop-windows/installation.html#dont-install	Teams.exe, 00000000.00000000.2017183545.00000000004E0000.00000002.00000001.01000000.00000003.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/api-ms-win-core-timezone-l1-1-0.dll	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/app.asar.unpacked/node_modules/slimcore/bin/sharing-indi	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/12x12-dnd.pngd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.netsupportschool.com/tutor-assistant.asp11(	client32.exe, 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.dlld	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.txtd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/tempfiles/sample.ftz	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/locales/locale-ro-ro.json	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x64/is-IS/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/assets/20x20-dnd.pngd	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://defaultcontainer/lib/net45/resources/meeting-addin/1.0.24151.1/x86/is-IS/Microsoft.Teams.Meet	Update.exe, 00000008.00000002.3512878472.0000000002F97000.00000004.00000800.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
52.113.194.132	unknown	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
91.108.101.4	unknown	Germany	201596	THREENETASNO	false
2.19.126.154	unknown	European Union	16625	AKAMAI-ASUS	false
2.19.126.151	unknown	European Union	16625	AKAMAI-ASUS	false
20.189.173.18	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.189.173.4	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.182.143.213	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.168.117.170	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
20.42.65.85	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
52.182.143.215	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
172.64.41.3	unknown	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1462647
Start date and time:	2024-06-25 21:00:25 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 13m 38s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	21
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	Teams.exe
Detection:	MAL
Classification:	mal51.troj.spyw.evad.winEXE@23/648@0/11
EGA Information:	Successful, ratio: 66.7%
HCA Information:	Successful, ratio: 100% Number of executed functions: 8 Number of non-executed functions: 385
Cookbook Comments:	Found application associated with file extension: .exe Override analysis time to 240000 for current running targets taking high CPU consumption

Warnings

Behavior information exceeds normal sizes, reducing to normal. Report will have missing behavior information.
Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Execution Graph export aborted for target client32.exe, PID 1272 because there are no executed function
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Skipping network analysis since amount of network traffic is too extensive
VT rate limit hit for: Teams.exe

Simulations

Behavior and APIs

Time	Type	Description
15:01:25	API Interceptor	1633460x Sleep call for process: Update.exe modified
15:03:29	API Interceptor	107x Sleep call for process: Squirrel.exe modified
21:01:24	Task Scheduler	Run new task: CSCOClient path: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
52.113.194.132	original.eml	Get hash	malicious	HTMLPhisher	Browse
	[EXTERNAL]Response Requested_ Rockwell Automation Machining RFP (1).eml	Get hash	malicious	Unknown	Browse
	Gabrielle Walker shared REMAX Confidential with you.eml	Get hash	malicious	HTMLPhisher	Browse
	phish_alert_sp2_2.0.0.0.eml	Get hash	malicious	Unknown	Browse
	Payment Notification.msg	Get hash	malicious	Unknown	Browse
	phish_alert_iocp_v1.4.48 (62).eml	Get hash	malicious	HTMLPhisher	Browse
	phish_alert_iocp_v1.4.48 (60).eml	Get hash	malicious	Unknown	Browse
	_22_2024.eml	Get hash	malicious	HTMLPhisher	Browse
	http://117.212.168.75:43380/Mozi.m	Get hash	malicious	Unknown	Browse
	original.eml	Get hash	malicious	Unknown	Browse
2.19.126.154	https://steamcomunmnity.com/app/1648293/STALKER_2_Heart_of_Chornobyl	Get hash	malicious	Unknown	Browse
	https://analyticalconsumables-my.sharepoint.com/:o:/g/personal/peter_hermans_analyticalconsumables_onmicrosoft_com/EiUw1SZmcnpIsJKM9QME60wBSCB6mqVVmSHteVl_jwlrew?e=nAWAzX	Get hash	malicious	Unknown	Browse
	https://mnrtrainshed.sharepoint.com/:f:/g/programmanagement/EsTfYadMW7dJiQrxoXzCjJgBsMISCkhyOE2uLzFWsW03Mg?e=5%3aXfsNo5&at=9	Get hash	malicious	HTMLPhisher	Browse
2.19.126.151	original.eml	Get hash	malicious	HTMLPhisher	Browse
	Payment Notification.msg	Get hash	malicious	Unknown	Browse
	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse
	0af4a52e.0cce76886785b0ff1283f346.workers.devemailantonio.cataneo@axactor.com.msg	Get hash	malicious	HTMLPhisher	Browse
	https://tiekinetixnv.sharepoint.com/:u:/s/TIEKinetixFR/EZxVzr5TJ9RNlghrK9vMHjEBdB4Y7tZOueHhnqYqpFR6vA	Get hash	malicious	HTMLPhisher	Browse
20.189.173.18	https://www.ammyy.com/it/downloads.html	Get hash	malicious	Flawedammyy	Browse
	Quarantined Messages (2).zip	Get hash	malicious	HTMLPhisher	Browse
	Payment Confirmation#U007e#U007e6985.rtf	Get hash	malicious	HTMLPhisher	Browse
	Acrobat_Set-Up.exe	Get hash	malicious	Unknown	Browse
	https://mcusercontent.com/f90a94ab9a71ed8b1e1a19a83/files/8ccc582d-8aae-bd3f-bfa2-daed6ec1206a/REBA_Retreat_2024.ics	Get hash	malicious	Unknown	Browse
	Adresse incompl#U00e8te ou erron#U00e9e.eml	Get hash	malicious	Unknown	Browse
	https://nvys.nettekks.com/	Get hash	malicious	HTMLPhisher	Browse
	923] (1).eml	Get hash	malicious	Unknown	Browse
	Biolegend Announcement No.680213 Export Control Checklist DD Slip February 24..eml	Get hash	malicious	HTMLPhisher	Browse
	OriginalMessage.txt.msg	Get hash	malicious	HTMLPhisher	Browse
20.189.173.4	9d565bee-e6ce-1842-e729-b0df8f08ed34.eml	Get hash	malicious	HTMLPhisher	Browse
	SecuriteInfo.com.Trojan.Agent.19085.17583.exe	Get hash	malicious	Unknown	Browse
	https://myworkspacea9fc6.myclickfunnels.com/onlinereview--6a2cc?preview=true	Get hash	malicious	HTMLPhisher	Browse
	original (1).eml	Get hash	malicious	HTMLPhisher, ReCaptcha Phish	Browse
	https://dovenest1-my.sharepoint.com/:f:/g/personal/andy_mottershead_dovenest_co_uk/EqT_gsDs1IBFjGAuhcxIv8cBxnpXyR5sOaffrWIOFzHmtQ?e=UL2sF0	Get hash	malicious	Unknown	Browse
	https://vk.com/away.php?to=https%3A%2F%2Fhhu.tmw.temporary.site%2Fwp-includes%2Fmyevri&post=809587144_14&cc_key=	Get hash	malicious	Unknown	Browse
	Employee f.colgan 2024 Pay Amendments D767104-0000.html	Get hash	malicious	HTMLPhisher	Browse
	https://www.microsoft.com/en-us/download/details.aspx?id=35460	Get hash	malicious	Unknown	Browse
	TAX INV_No. 68430304.msg	Get hash	malicious	HTMLPhisher	Browse
	https://www.officence.com/nam/d22d141f-ae37-447f-acfa-2e1d0e5b4969/5b612265-0eea-4eb4-af80-6e0eff5a34f2/9bba8c17-6f40-430f-a99e-bc600154d01c/login	Get hash	malicious	Unknown	Browse
52.182.143.213	YoutubePlaylistDownloader.exe	Get hash	malicious	Unknown	Browse
	New Time-Sheet Report May 15 2024.eml	Get hash	malicious	HTMLPhisher	Browse
	https://netorg442802-my.sharepoint.com/:b:/g/personal/darek_daronto_com/EeXtnEaZ3XJBqGk13it6odUB-K9vuYAC7zp7SfyciZ3BpQ?e=nkKu2w	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse
	https://url.us.m.mimecastprotect.com/s/kCCtC5yEz0tWp5ANrfz_KPV?domain=paplastics365-my.sharepoint.com	Get hash	malicious	HTMLPhisher	Browse
	https://baa9317d.2f56456f2183621a6a918466.workers.dev/	Get hash	malicious	HTMLPhisher	Browse
	Receipt_2821-Overdue-PO.msg	Get hash	malicious	Unknown	Browse
	ACH-6573-15March.xlsx	Get hash	malicious	Unknown	Browse
	RECH17321732_9e5ae629d707dac3d5517e7b2c0b05146fe4fdc0_f3e673ac82dd560f7e8de3126a1d027384a77c29.docx	Get hash	malicious	NetSupport RAT	Browse
	https://netorg8522087-my.sharepoint.com/:b:/g/personal/anitra_retreatofatlanta_com/Efg0bq8BHKxBhSDlOSDbuBEB9K9zdLJabGA4dQ8dH8UXBw?e=7NIADy	Get hash	malicious	Unknown	Browse
	https://netorg5340145-my.sharepoint.com/:b:/g/personal/info_curreg_com/ERWUgunUKWdDoEpnpewg4S0BeV_zc9P4BqPEDSGk7NgP5Q?e=vHfJIQ	Get hash	malicious	Unknown	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AKAMAI-ASUS	original.eml	Get hash	malicious	HTMLPhisher	Browse	104.102.23.137
	[EXTERNAL]Response Requested_ Rockwell Automation Machining RFP (1).eml	Get hash	malicious	Unknown	Browse	184.28.90.27
	Gabrielle Walker shared REMAX Confidential with you.eml	Get hash	malicious	HTMLPhisher	Browse	2.19.126.160
	Authorization code - SO10552124.PDF	Get hash	malicious	Unknown	Browse	23.47.168.24
	https://messengeravl-my.sharepoint.com/:b:/p/joe/EUaalaFNBFVFgzqdWjgwP10BDkdHrky0cuqdP-RpLXIPLQ?e=jfHJMy	Get hash	malicious	HTMLPhisher	Browse	2.19.126.199
	https://smktricitiesinc-my.sharepoint.com/:o:/g/personal/lsmith_smktricities_com/EuKjIiK9a3BDhtQ_zWda63MBH_bw5P5jEl58W1f_H8dR5w?e=5%3aks84XC&at=9	Get hash	malicious	HTMLPhisher	Browse	2.19.126.199
	http://playsportzone.com	Get hash	malicious	Unknown	Browse	2.19.100.239
	nEtQ9BP9hL.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	ChromeSetup.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	Gagnon Levesque.pdf	Get hash	malicious	HTMLPhisher	Browse	23.47.168.24
THREENETASNO	Assigned File_ NO_84-7460327 Service Agreement_notice.eml	Get hash	malicious	HTMLPhisher	Browse	91.108.122.17
	https://amgraphpackaging-my.sharepoint.com/:b:/g/personal/bill_porter_amgraph_com/ERqPRNocNI1EhInqBXiZCNcBcNlJy6x3bcIl0rs7cvc1SQ?e=hkckXP	Get hash	malicious	HTMLPhisher	Browse	91.108.102.77
	swift copy USD65000.exe	Get hash	malicious	FormBook	Browse	91.108.98.129
	ftrrrttyt.exe	Get hash	malicious	FormBook	Browse	91.108.98.61
	DHL Arrive Notice doc pdf.exe	Get hash	malicious	FormBook	Browse	91.108.98.94
	https://ios-trezorsuite.com/	Get hash	malicious	Unknown	Browse	91.108.98.113
	http://alphosoft.com	Get hash	malicious	Unknown	Browse	91.108.98.80
	hilcorp_Salary_49372_2024.htm	Get hash	malicious	HtmlDropper, HTMLPhisher	Browse	91.108.102.252
	https://postnoord.dk.yiff.fi/sunia/u/r/	Get hash	malicious	Unknown	Browse	91.108.112.166
	https://www.canva.com/design/DAGAKNghr4A/3gUMtWRotAcalbbQiAq1GQ/edit?utm_content=DAGAKNghr4A&utm_campaign=designshare&utm_medium=link2&utm_source=sharebutton	Get hash	malicious	HTMLPhisher	Browse	91.108.120.124
AKAMAI-ASUS	original.eml	Get hash	malicious	HTMLPhisher	Browse	104.102.23.137
	[EXTERNAL]Response Requested_ Rockwell Automation Machining RFP (1).eml	Get hash	malicious	Unknown	Browse	184.28.90.27
	Gabrielle Walker shared REMAX Confidential with you.eml	Get hash	malicious	HTMLPhisher	Browse	2.19.126.160
	Authorization code - SO10552124.PDF	Get hash	malicious	Unknown	Browse	23.47.168.24
	https://messengeravl-my.sharepoint.com/:b:/p/joe/EUaalaFNBFVFgzqdWjgwP10BDkdHrky0cuqdP-RpLXIPLQ?e=jfHJMy	Get hash	malicious	HTMLPhisher	Browse	2.19.126.199
	https://smktricitiesinc-my.sharepoint.com/:o:/g/personal/lsmith_smktricities_com/EuKjIiK9a3BDhtQ_zWda63MBH_bw5P5jEl58W1f_H8dR5w?e=5%3aks84XC&at=9	Get hash	malicious	HTMLPhisher	Browse	2.19.126.199
	http://playsportzone.com	Get hash	malicious	Unknown	Browse	2.19.100.239
	nEtQ9BP9hL.exe	Get hash	malicious	Vidar	Browse	104.102.42.29
	ChromeSetup.exe	Get hash	malicious	Unknown	Browse	184.28.90.27
	Gagnon Levesque.pdf	Get hash	malicious	HTMLPhisher	Browse	23.47.168.24
MICROSOFT-CORP-MSN-AS-BLOCKUS	https://otoegaming-my.sharepoint.com/:b:/p/tweatherly/EYFNG9mnIXVOkko-CbUQhkQB6nWmPq5XsZcy6Jkg3GmPVw?e=4%3ajsPeZt&at=9	Get hash	malicious	HTMLPhisher	Browse	13.107.136.10
	NEXT Oncology.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	original.eml	Get hash	malicious	HTMLPhisher	Browse	52.109.28.47
	http://www.xfinityconnect.comcastappmobile.162-240-172-219.cprapid.com	Get hash	malicious	Unknown	Browse	13.107.246.60
	[EXTERNAL]Response Requested_ Rockwell Automation Machining RFP (1).eml	Get hash	malicious	Unknown	Browse	52.109.76.144
	Gabrielle Walker shared REMAX Confidential with you.eml	Get hash	malicious	HTMLPhisher	Browse	52.104.79.25
	Authorization code - SO10552124.PDF	Get hash	malicious	Unknown	Browse	13.107.246.60
	https://messengeravl-my.sharepoint.com/:b:/p/joe/EUaalaFNBFVFgzqdWjgwP10BDkdHrky0cuqdP-RpLXIPLQ?e=jfHJMy	Get hash	malicious	HTMLPhisher	Browse	13.107.246.60
	https://smktricitiesinc-my.sharepoint.com/:o:/g/personal/lsmith_smktricities_com/EuKjIiK9a3BDhtQ_zWda63MBH_bw5P5jEl58W1f_H8dR5w?e=5%3aks84XC&at=9	Get hash	malicious	HTMLPhisher	Browse	52.104.59.55
	https://netorgft7291189-my.sharepoint.com/:o:/g/personal/cathy_summma_us/EkmeLg9P_xJBvJgYLJCASRsBXZAdGu54shHJD-Wh-l1EqA?e=5%3am596PS&at=9	Get hash	malicious	HTMLPhisher	Browse	52.104.127.41

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\MSTeamsSetup_c_l_.exe	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse
	TMSSetup.exe	Get hash	malicious	Unknown	Browse
	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse
	Setup (1).exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse
	TMSSetup.exe	Get hash	malicious	Unknown	Browse
	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse
C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\AddinInstaller.dll	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse
	TMSSetup.exe	Get hash	malicious	Unknown	Browse
	MSTeamsSetup_c_l_.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\ProgramData\MSTeamsSetup_c_l_.exe

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1447792
Entropy (8bit):	7.574974695457159
Encrypted:	false
SSDEEP:	24576:B9Yu8GgnSf7uw7O8qGVniQjY2nyZlEe+NB4HNoP8Bw/F3cjtBxVTNbpM7Z3afU:AGMo7NPVFjY2nyZSNB4t48sUjbpcZ3t
MD5:	CF0E0F57B68A11D099EC944200A6069D
SHA1:	1DDC31265D8DDDBA4F82FE34A66A1BC4000F93AD
SHA-256:	73354811E3109E265821124A18B1B7D9FD3DD1207BB46C18937D250C6AB46DEC
SHA-512:	D0F7CC46F8C1FFFEE67528C57A91A693B574386BB86EC85C8FE0684FC305A6A5121965DF4470950E36D2E1025C6EF435C58534D1885AD0C7CFB07759B2EE5C0B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MSTeamsSetup_c_l_.exe, Detection: malicious, Browse Filename: TMSSetup.exe, Detection: malicious, Browse Filename: MSTeamsSetup_c_l_.exe, Detection: malicious, Browse Filename: Setup (1).exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......M.],..3...3...3..O....3..O....3..O....3.[.0~..3.[.6~N.3.[.7~.3..,....3..,....3..,....3...2...3...:~..3.......3......3...1~..3.Rich..3.................PE..L....T.e.................H...~.......E.......`....@.................................,.....@.............................................................pM......P1...u..p....................v.......v..@............`...............................text...F.......H.................. ..`.rdata..hZ...`...\...L..............@..@.data....&..........................@....rsrc...............................@..@.reloc..P1.......2..................@..B................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Squirrel.exe.log

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	2420
Entropy (8bit):	5.348263469623871
Encrypted:	false
SSDEEP:	48:MxHKlYHKh3oTH/xHgJHreylEHMHKoHHitHo6hAHKze/HvHA:iqlYqh3oTfx0aymsqaCtI6eqzuPg
MD5:	A77B203DA07012C97A819DDD42609F42
SHA1:	514300571A52B508BEA85AF31E62D975EC090D1B
SHA-256:	2728DC08E1A592D6B13C74CB177D2E133A7523E48C129D4FA7261AE8EA53FFE4
SHA-512:	AFECF33580B6FD0F93749C7C32CC08657BAD14E217059DD4464D77CE8B91D9C7216BA66BFE6B55037B00219F67D5E4C0B7C517182D530B131BB50F3186316378
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime\32bcd6ad56338e82b2e9ecba5600bdb4\System.Runtime.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3586
Entropy (8bit):	5.365060918503364
Encrypted:	false
SSDEEP:	96:iqlYqh3oTfx0aymsqaCtI6eqzuPOGqzyRW3jlqcEGwD:iqlYqh3Mfx0atsqaCtI6eqzuPOGqzyRV
MD5:	85FB6A4800E27CA168CEA36B58BDE6D0
SHA1:	F3BB95CFEB500206898544C19C4D4F508AF4C2AC
SHA-256:	EC8C86031D452B75FDC110E27493B17044231281CAE96341BC2564D07C0E540A
SHA-512:	A09E369F354BA88821681D9658761EFC7B723092FA21625EC78634CC1E7574CE0514A66800A0E7E4990FBCF2E77DD1F235F96CD58B65792CCD4CE52D87FE8055
Malicious:	false
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Runtime, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime\32bcd6ad56338e82b2e9ecba5600bdb4\System.Runtime.ni.dll",0..3,"WindowsBase, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\4d760e3e4675c4a4c66b64205fb0d001\WindowsBase.ni.dll",0..3,"PresentationCore, Version=4.0.0.0, Culture=neutral, PublicKeyToken=31bf3856ad364e35","C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\17470ef0c7a174f

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\AddinInstaller.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33864
Entropy (8bit):	6.6749170427672215
Encrypted:	false
SSDEEP:	768:bgYy+J05SY3wauWD5Epw9z9gElzEpw9zT:FMcYgauA5Ep4z9ZzEp4zT
MD5:	7F17A972A3F083FC309E93C9ADA8AA10
SHA1:	0072330558FB6E91FE6801DE71ACF06A716BBA5C
SHA-256:	98B6CD35884C8AE37F33196A132D0029100C0BA8AD2EE0C084A4870CFA832214
SHA-512:	D2B924E1BCD5EB260B17CB58E527E87D6FA9E772088F95DF6369599D7C4FFA3866F83D35F6AB333667C129FA8AE9CEE781A46FE8781B37906A60AFC301EC48CA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MSTeamsSetup_c_l_.exe, Detection: malicious, Browse Filename: TMSSetup.exe, Detection: malicious, Browse Filename: MSTeamsSetup_c_l_.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....q..........." ..0..............L... ...`....... ...............................6....`..................................L..O....`...............6..HN...........K..8............................................ ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............4..............@..B.................L......H.......\)..."...........................................................0..y........(......(.....(......(....-..(....&.(....(....,C.(....s....o.... .. .j1+.(....r...p(......(....,..(.....(.....(......&.............ou........{...."..}........0..D........(.....s.....(.......r...p(....r?..p.(.......o.......,..o ......&..........'4..........@@.......0..^..........&...%..\.%../.}.....(!....(.....s"...%rC..p.o#...%rI..p.o#...}.....(.......s....}......&..*........E..Z.......0..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Large_120.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	7.73830447681088
Encrypted:	false
SSDEEP:	24:+5DjKVMPFXHX5S4wKHWKWZGmy/xRftEircOiO8UN7O3:+5i8HplNRmKtFPPo
MD5:	E3B1BA3900BFFAE493B4463F9A6FBC48
SHA1:	0BDDCAB7F9537F01900CB7A7AB0FBB1042E460E7
SHA-256:	8FDE3D7378D0E9148068C3A9406D5BD754E93C9810FF5D2B8535FC2B65E0830E
SHA-512:	8CA0A6304BD871B1F2BECCF6AF9CBB2EC97D05B233B9388CFC760B262509B8BF6F9B50B837D21018FCA6E8627FA11AE67F6AF49440A837701B4C9AE920585246
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....sRGB.........IDATX..W[h.A..w.5..4.-..PA....(>@k.\|..._.OA.k1.X........-..a.(..?.)...........hv.w..fw.... .Xf.>..s...@......z...........;%I:.9V.....B.>.;.$.@d.C@.%...W4.K.......).#.....I..u.Fr........8.8....z...UQ......$Y..R.n..#....L.9{.&M.h.6...P"zUQ...a....:.D..Nr.[.u...L.>....K."..'..t/..Yz....--...M.]...e..0.l....!.r./)r.].t..U!.l&...;....i.,I.TD.H......).S...D..P...sV4!.......K.r.\|...... ....Q^.5P.VI...`'.........`...S.Z......?............`......9....g..[.i..Z.\:#.T......2t).b.........Y..<.T...u.`...... \..nL.f.....3A....'7..zDi-....r].k/Hfk....b:......@.k...,D.k...#.j..Z....@<...}2.a:$...Q.vL..u...o.Z..\|I.r?.o.;..".8..{~'.l..fG3...x...W...%V.....h...!.;...gA.$.?F.w..Y...1!..yu.].....fW..>..w..).55b....D7..}.?...._...=.....".+..N.\Z.mup..p..d\y...r+........:..G.Q.S....>..9..[.L.@\|.:..qMP8E.B......R7;....Pk..F.......s...N..F@.B.G...0...e.:....T....d_....i:.........5....].sa^.@!..#....'.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Large_144.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1237
Entropy (8bit):	7.788008184019191
Encrypted:	false
SSDEEP:	24:GVwVpPtyAjoNiCkbbtwi0G1UA9WdK+oJgsQ6QVdAmwQATjZWwrpFbVD3r:E6FjowPv70tB/oJgl6Q8mXAT1XLr
MD5:	6974CFC337BF190D728C6824EF94AFB6
SHA1:	741DABA13F01C19518E2E1E72A93DF2C96227934
SHA-256:	115340C0940669C7A55670F03737492FB86D5E34E0390E5664EEA3F9B4147B0C
SHA-512:	679AFA5D417748680624314A6E5FF63CBF37D11BF5E95FD2D2114076F1DCD75196849EB39B1D456A8A5DB0019EF2C4C2FD61EA70651DAF158B87A69D8B017FAF
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........IDATh..YOlTE..f.n....Hl].' ..(.1.......$...&....4.&..=.@..A{C...`0.....$.@cz......m....7~....7......%....}...o...H.$.Ow..r..9'.CS...G.{.j...@F..3_.Bx\vc.`xx....g0..&'...m...\...(F...$/2...+.[..%y.(.A......sZ..Z...._.2..V......."[...SB.Y}....%eUV..@...V......G...8.Q....3..}...+.Rq...`]...\.U..yL.V.<.Z.{.1..5P/".&H...5.....D..x.:..m.b.....l..Gl..S.y....."...k.....cX{i.p..pFHtV.8..)....Y...,;U....O,XQ......,.Z.Eq.V7....B.0..b.......Bs.....Z.........}..wp....E......U.......F..........av.#.!.../.......b..rG....E...ZV..W..]w...\..~.q.f.#...K(.2..bU/.L/.b..7?.....6Cg.y.{.R.......9.O..n..H....tYb....ZR.<.t)-c..t..... ..x../....;..D..k..D.....`.J3.d...m..d.LYi&..@3.-l......z.pE.T..Z.u..R..."P.(T......7.%.... ...9.%.....O..p..5..bQ.F..o.u.o.2.B.....l/...1.8-..e....B......\|P.E....vZZ;.Pj...b)..z..r3..s~../B..k6}Z+.."V..[.......T.D.jAU.n1.%f3:.Y..s.{..*..`I.$.....w..T.H...?..:X..OQ...b.N...

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Large_192.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	7.805621612269991
Encrypted:	false
SSDEEP:	24:xyPSt6BuLqrVii+xXSCLqmgDvjUEAkgoX1Amyz/zaY6pGtqPgmeAkG0ZZz:cPSt6G2iimqm+6kgDl/t6iEfGz
MD5:	177094A528723CEF49FA2FFDFAB57CF5
SHA1:	CBAE150EDCD83F2E9BB87A0BB86CF076EEBC41C2
SHA-256:	66CD5E3CFC69AF5087D33C570CFE424B50935B01C27E618CA11822AC7AE6D1E6
SHA-512:	AD9394116D2E132EB2BFF48F1AE4AB7AEC5B372FFD2B7B41E29CD8BF26C87725BB48D0C3AD85F7C3C94B4556872A06876D1E95F4AD8A0CF63DD949DBE350D8E8
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........IDATx..Z]L.U.>..,.. .[)6<..b41.`..4M.>h..........&.H.l.Y_L..6..&ZiS./.'1....X...F)....dw.z.....30..:7......9.g..@.........n_..V.........]...9F9.?..2C6...u.h.#.....?..19...U&....P.@_.R.#FY..&....P2~.....~..J..(../...I .y..Q.R3....Q.y....a...8)cwv^.-...?..6s....\|....'Z.e:.4_..w....).Uz./\..........pG......N<...1.;..X.XO...a.../.OS.._.).... ..e...dz........\././...u^..-Q.'..R..D.l...._1.5..G. ...t=,a..Bbz.+$J.BNB...V.&7.3....&,..Y..u..0w....}.......v?wv....TF-vN..&&f,..\.#5.....6=..p....y{3...m1....X.(.-VjqO..S..u.x...e..,......3p..."..`..@..0U.d.Le.,......\|.....A.d.f>.......m.....{..T L......kD>.....K.....4Qv....J=...o;[...4d. .....O.S_...I.y.....Q.\..><.....8......r.T.?3.eK.......b..~.@9.....ll......Pkyh...n,m..o.\..&.ai)YJ>E.......I......rWG.tu..ftl.^..R...O.Euu%.....&&K.......Hp.Lx.......K....cE.,a..`.1....i.h.5..!.......7......u.OP.n.[o.A...;.6....".&..o..v.4(34tj......U...C...u...S.N....H.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Large_96.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.630755600269692
Encrypted:	false
SSDEEP:	24:L9IW0j2BjoUb25MCbt+OzOGKynRHS/0psG7:LaW0l2Ut+ONRy8+G7
MD5:	FAFBA571265B20E0EC4423FEAD972E1B
SHA1:	B686D74FF48E3B990F0E312BB0F3AF4E8F53069A
SHA-256:	1FB3B4832E92B1E2F998CD2FF4A872000822CBB897D869194195E5C4F8D43CD0
SHA-512:	D0523CCC27436A80C5A14094AD244349EFE68FB5A813F97539C3025FCC1F05D6CEC9B8FFD04883E35BCD787A36901246687162B4B86717E81E747B2CF035DD2D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB.........IDATX..VMh.A....i..$-j...C..M...`.T..A..,6.VYj.T..(....=.^...E.....b...4i$.I.....n....<5......y.fv....ZM.z7..Z..QB...t.V..cj"...gK...e........YI.>?$.V.^......ZF...av..cn....Vi.]P.(..).v..Y.P..s....D./n&YpJ..iG....8.Z:..._.......................~3.......Y\.T...H.J......n....c.p...x.n:....i>....i......i.GvLd....SRx5?.....3G...3...i....th.5...._..CGy.....R..q.I.>....\.e>x...#......v...L6OV....uR&.....o.#...y6...c...r,..#...B(..e:.K.6..:.r....+./....g..@..!....N.....=.H....#.....j.K..F.&6Zk..."......d....].Vl...IG.......:...]w$p.+...4.......k.j...$.ja}..x...(%.x.9\|..a.d._0sy..>oL.....%<.0.C.....;..(.!tpb"...N.R.Nj..?.."...RH.......8.Gb.P.i..y.L..OMv.Q.o;....[.sQ$A.8}3..cn.!wn.N}..m..#x.'......jV...T.G.?[..3.)......X........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Small_120.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	574
Entropy (8bit):	7.347738166641519
Encrypted:	false
SSDEEP:	12:6v/7iHKcqzpeXnDvyEqCcmpZndaYcfyYCta8eq0NRFWBOfmcN274Gl2E7:6cqFeXDvyEqEpZdaYcStx0LFgOfzkUD+
MD5:	503E86E4628933D17B5B41B4918D6C9F
SHA1:	F884F45CF4EF5B435E554EA30F654F076E50BDF5
SHA-256:	1C80CC98643E1D060B9443C98E9AFE663125398F7BB99E5BAB2C0EB952C9C111
SHA-512:	22D115A09597F7A8CB0C5BCD0E0BBA55798D3A431B28EC27E9DDAA356BF0AF674BDB78E6D9A3911E2750354D42A8AD628EBD0A7716410360F6D1160258E12C98
Malicious:	false
Preview:	.PNG........IHDR.....................sRGB.........IDAT8.c`.....:.....o........'XX........K.&.2.....`>........}....Y ...Li...n.......K....103.1pq..u.].. ...g........`..C.^.......w...~20...k..4.....d>....0.Bv...~.....>P...A.dddx.. 6L-8R......lY.....>!{..k]8.._@.V.W..@1.&.2.f.L...S..f..L.`...'...Oa.@....f../#.....d........G...F!..c.U..-%..q!#.5d].V.G.2.........$....k....Y.....=V.8......8S....#J....e I.YOQ..)0.(.L`..`db.q............4\|.(.s.H...,....Y+a&..r...D:aecm...&..q....Q{..[#.+.a.a4..]b.B.`\|d.g...c..j-..L..@\|../@'...........".D36.@J.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Small_144.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	627
Entropy (8bit):	7.55832772949955
Encrypted:	false
SSDEEP:	12:6v/76fR8ZKPil+HE3xZKPwUonTJibKpwwCzc8oRNn/Dna+z:7R/PUsE3xZ/zsbKpcI3Dna+z
MD5:	75713D844925AC3404D59C5D56DD996A
SHA1:	88F0F5B5450772A85FD61FB5FD54C3A6F7E48585
SHA-256:	D4746496079E9C334715958852FA8FB59E54DBDEAD19D83001FA15C1793D27B2
SHA-512:	B60E132BD5251084B2C7A22591D72DFDFEBB7A24987ADB8E78CA345694F6043C1F3C7A9205B6052CF3846FCF33179506BFF88C1D1BC8093A7563CF150EC5D30A
Malicious:	false
Preview:	.PNG........IHDR..............w=.....sRGB........-IDATH..TAKTQ.>.7.o&.Y.e...ZhJ..\..-.6AK.@...b.+.h+.. .].m.pg.m.. "....7.x...;...6E.....\|.\|........&.@..../.....A.[..}...p.Y..Y....j(i_c<)...X \.nq)......OO#.........I,......-.....].4..d.!.....,..Q...vu.-PP.........\|.Q^t..@.^..dQe....^/y..'....mA....o.h.....t...x.........A..?q...>....<..#g...S .\..kko.\....l.).L.L.7.l..!KwbP.?" ...?,.w.q-....y.".\|.O....Y.4..^J....sC..Z.;~..R....8)H..p.....L!.......[^k.+.u..w.4(.1.Z..q..G.AM..{.gj..L.b.\...\.m~..N.<.f..........Y...K0J..E..^.....D)?..c,.../].p2..1.2.D_u.s.x}...?TL.?~..;P..(.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Small_192.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	875
Entropy (8bit):	7.664401472706693
Encrypted:	false
SSDEEP:	24:MnF5WncYHQTt0feBgmzpRjRqgnoEmDDxM4xr8LTdIDg5X:MFAncIQhee+mdlRlTmW9uDg5X
MD5:	F323D73771349B6374462B8A4B708D83
SHA1:	39F8860AEC7AC9FF8DF80C770A23F3AC8C3BE4A1
SHA-256:	EA0327CD2D987CF069747F70A317E552C0304170177101AA578F04D2EBE9FFB6
SHA-512:	5377FD3886FCDEF87B61F1CC825655E6B977E370563B2C2F7B3BB675B8ADCCE621A47F056945A9C0A41F9C10BF4DF6694167E62A310B146587F898D39E753EB2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB........%IDATX..VKh.A..I6O.H..$....../Q."....z...x. ..."X..`OR,.C..Y.h=."^....Q.U...ib.;..ufg..d7.P.......?.L...p....Lt...-.P/...^I..X4.X..........A./&..'%'.k.....,..\......l.j'Y1f...L.....~p.?n^..N+6xF..^}...3...`..(MN..Q.H.0^`XCG.^[z......X..0r..\E.n(..@..b..#....._....\..=.,...#.7.....t.x......I.$..-..W1F..o..Q....x...P)......S!......v...zd......+...#...O.....Q.........!..2...$....p.X....g.5....e.o"..V..yQ..I.a<9?..\|.t...Z..O..Bv............Z.........r...W#...-.`.(.0.Alkp...7a-..../....Mt`.g.......4.].5.z.X.Z...gz....R.S......-.1.w`a.......<........"..E.4\|.X..T...no.M0./..F..k.P.uW.].f$9.pY&......Un..N.3\|.......`.....2..e....C......r...g.Oj...t..`..s...PE.].v.,..S.J...P@u..q........[G..0..0...9..Z2].u...\|......Ru.......}...6...W&z.4.S..0\..K....n.@a.Z....(..9.........3._.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Small_96.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	483
Entropy (8bit):	7.310129121242215
Encrypted:	false
SSDEEP:	12:6v/78zmIphkxF+oabzkBMDRbuyP+3uvNg9e8lJD+SF330YN:46m0hRl+3q+nD+SiK
MD5:	A2761DE768472D09D1E02C92EBD144B5
SHA1:	60BA18F0FF47B9E9C3E23B5AE9E95E3D319B5C5D
SHA-256:	AC7FE3232888BF96C520D586C723149CD3127E1CE7CC65BC35BA1984CC27BBCA
SHA-512:	F330DB55B79E561D2DAC1CD051421F91D6981A489A004EB0EAE3AE090B1386DDF46EFB675A9B6F75A0BB83F741B5DA12E4DFB872EE41782773BFAEC9014CA667
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........IDAT8.c`..0..?i.......e....?#.Nq>..<...Y..`.W...00.......?..........;.jX.=6,4....N.\|~....._...K1.....A...l....>.{..m....2........;?...<.......\a./.tA.H.?... .l..f.......s....p...V.KB.x.D.)2D.)....l.}........`.....u.!...7,7....H.O.^.B....?..`.D..2...C..e$..:...7...B.`d`..R..D`0?.....~G1.?....KFF...L.. I.(.+6..z...).....d......5.h..q.+.2..,( ,W%-c.....Y\R."........Y..... ...7.@..?..-....JkZj.w.....e.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3097696
Entropy (8bit):	6.376562383850651
Encrypted:	false
SSDEEP:	49152:RSYwMLWjLsGKN44mG3uTMnnl5S6niJO+L2U1W1N1TfEoqeoR:QwxNN45G+TMnlXNq/
MD5:	65EE46B3B363F0673FD6381DE42E69D8
SHA1:	515FC59976C50C95E99ACB0C046BDA605BE4C130
SHA-256:	049A56425A4685160A94DE4560AA514F3F575D62D99CB0B10BE2C23F10E9D377
SHA-512:	C7A115E277C9823E64F665FD255C7257B387AD29A51D51A3BD75F76D77DE32230928A157A5FBA211B0D8ECF8F66E317FD5F84FC18F43C6116CC5925366B6F539
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: MSTeamsSetup_c_l_.exe, Detection: malicious, Browse Filename: TMSSetup.exe, Detection: malicious, Browse Filename: MSTeamsSetup_c_l_.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$.\|.E./.E./.E./..I/.E./.-...E./.-...E./.-...E./.-...E./.=Y/.E./.=I/.E./.E./4D./8,...E./8,...E./8,...E./8,%/.E./.EM/.E./8,...E./Rich.E./................PE..d....6=\.........." .....L..................................................../......./...`.........................................`I,..P....,......P/.......-.h.......`N...`/.p.....$.8....................!).(...`.$..............p.......G,.`.....$.H............text....H.......J.................. ..`.nep.........`.......N.............. ..`.rdata..8m...p...n...P..............@..@.data.........,..\....,.............@....pdata..h.....-.......-.............@..@.rsrc........P/.....................@..@.reloc..p....`/.. ..................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.JsonWebTokens.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78408
Entropy (8bit):	6.129481246167649
Encrypted:	false
SSDEEP:	1536:nm6516C0z6v8JyJNPk2DuttJ6gDEkeLGzewZGLzw00f:nmqEC0zhyJNPktDXiGyRv0f
MD5:	EEA13258A8B7DE541A74D2912769F2A7
SHA1:	542082376A88F30ACAE47D71737A043A05334B1A
SHA-256:	E4FA6AC046B919137158954B182A647129990B70399C9894CE6918F0FA893262
SHA-512:	A8E7A6F7476867199D2E499ED09F11742593B398FAC4B4F3CA9C2D3496AB2A1B80A5E439F4444342D0A30BB3C74FB1A616E508DD05BBAAF6E54681F5F56BF8A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{............" ..0.................. ........... .......................@......D.....`.................................Q...O.......................HN... ......T...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........[...............................................................0..v........s....}.....s....}.....(.....(....,.r...ps....z...@...%.....o.......i.....i.3....(,...r#..p......%...(....s....(....z...0...........s....}.....s....}.....(.....(....,.rd..p(....z.(....,.rr..p(....z...(....(.....!.r...p......%...(.....s....(....z...(....(.....!.r...p......%...(.....s....(....z.......C..Q.!......s....!....j.(....r...po...+%-.&~....j.(....r...po...+%-.&~.......0..F........(..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.Logging.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41032
Entropy (8bit):	6.710594759580758
Encrypted:	false
SSDEEP:	768:vS0Nb06pBrs9OoJu8Gw1OQaXV9zPgEllVXC4dC9zVj6N:vnb0NO217GnzPZ/C4dezF6N
MD5:	E6F3F341BAEB31F4196C3085FB34F767
SHA1:	D78EBC71D36B06E0DA7FA41E6D7888FCC71042B6
SHA-256:	4BE875B73CD50A95A1480FD3330222C278903DCFA9EE73263198D860827EA9AF
SHA-512:	A38A81B096D215E04947BDD2E7D1532E676C8E84DD9CD598D98EE5EBF5C1197CF1AC690F28DA0EAB3DC1CA42CE0CD9F1EAA0901E7CD55C1ECA927D86E880C365
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[c............" ..0..H...........g... ........... ....................................`..................................g..O....... ............R..HN...........f..T............................................ ............... ..H............text....G... ...H.................. ..`.rsrc... ............J..............@..@.reloc...............P..............@..B.................g......H........,..x9...................f.......................................0..I.............r...p...........r...p.....r...p.....r...p.....r7..p.....s.........:.(......(.....~.....~............~.....~...........~.(....,...(...+(.........(......(....,..,....(8...(......(......(....,..(.....2...(...+(.........(......(....,!.(.....2..,....(8...(......(......(....,..(.....2...(...+(.........(......(....,!.(.....2..,....(8...(......(....*..(....,..(.....2...(...+(....

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.Tokens.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	937544
Entropy (8bit):	5.838809981110096
Encrypted:	false
SSDEEP:	12288:uMt+vIZDreuKQvgXyexT4Yn2sxGwmBgjoIb:jVbgXyeV46xGjBgj1
MD5:	528D783F83C540EFC5F138D21E8C1696
SHA1:	64F87F45719CA06143AA6328A52E6A96285DA63A
SHA-256:	CE06CDE2B771E6E215CA9A10F8739A23AB2990A53C32301E42838D40E8E355F3
SHA-512:	ED2562BE767103C2FD7179B0F632A2250F8EF97950341C6D0FE6AC8BA347499682CF7201289169855F313D47833F863FCC110B54864A8BBABF046FFD8B5902CF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........." ..0.................. ... ....... .......................`............`.....................................O.... ..................HN...@..........T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........0..X...................T........................................(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{.....3...{.......(....,...{......{........-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..o....aX...X...o....2.....cY.....cY....cY..{......{...._..+%.{.....3..{.....o....,..{.....{......-....(.....0..H.........{...._....{......s

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248904
Entropy (8bit):	6.150746670116204
Encrypted:	false
SSDEEP:	3072:Le3vee9g5nwddPS764sTCYfMLG/Hb25jiV9MPsJvgk+TB:E9GGd676469Ma/RVKPsJYkA
MD5:	96E9C38D030B3ECB4E674227F2214272
SHA1:	8D6BFF68B89630C7DBCE8A5120110816BCD2B881
SHA-256:	170B6F45031B97C665AAF19B4A85E1DCE035243A0972CADFFD855B11E15C9F2F
SHA-512:	773C8E286ECC0AC57F14C6F46FB58327DE21F04FBC7B3977270D0A7770E0CEB9E0D4B60A79D1DA82E7D1F4FDD40AF9281CFBE78B27C180BD7B57C2F29E99B7C0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........S.^.=.^.=.^.=.W...V.=...9.Y.=...<.X.=...8.}.=...>.Z.=...>.\.=...9.[.=...<.P.=.@...].=.^.<...=...9._.=...8.V.=...=._.=...._.=.^._.=...?._.=.Rich^.=.........PE..d.....Xf.........." ................P...............................................>n....`A....................................................@....@..pj... .......~..HN..............T.......................(...p...8............................................text............................... ..`.rdata..b...........................@..@.data...............................@....pdata....... ......................@..@.rsrc...pj...@...l..................@..@.reloc...............r..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AuthLib.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40008
Entropy (8bit):	6.683761370543717
Encrypted:	false
SSDEEP:	768:3nom7dmnAf1LHF51ap+v/7pK+4nCLEpw9zUzgEl3H7Re9zno:39Rhaps7pnq2Ep4zAZXFazno
MD5:	8B49A5EDDC4FD8D66224C96F90637305
SHA1:	683B198B685AF5329EC6EC1171266AC84D3B7ABB
SHA-256:	04C9F32B9FAD48DF69E9675B30554712AC87659ED9B4AE29FC04007DFFF0092E
SHA-512:	C55A44341A8B748C5F7092C397D494B2A98922AB2C2B7CBC994640F6663647640FBA4E7BF33C5B4E01F4951BAC9BE68A764309D3C83BF49F247AB563A59776AB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...f.Xf.........." ..0..H............... ........... ....................................`...@......@............... ...............................................N..HN...........e............................................................... ..H............text...<F... ...H.................. ..`.rsrc................J..............@..@........................................H........-..t7............................................................{...."..}......{...."..}....V.(......(......(....~.(.....s....}.....~......}.....0..+..........{....~....(....,....{....(.......(..............##.......~......0..........~.....r...po....~......!...%.r...p.%...%.r-..p.%...%.rE..p.%...(....r...po.......{....~....(....9.....{..........(.......{....~....(....,r(....o....(....rc..p(....(....&.....(......~....(....,+....}.......(....&..@.(....&. .....(....&..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.Diagnostics.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32840
Entropy (8bit):	6.85712169528054
Encrypted:	false
SSDEEP:	384:z5BNiiCAlw5LfyacHbZTowwWYsQWSW/7R9zkV+Hh5yEFHRN7GNQSR9z+zCu:zrFo5xwlvfF9z6EhgElG6e9z0Cu
MD5:	D24A006BCE2DB1A2F0463714BDA1758F
SHA1:	1DBDAF547C164430F8A1E59F4DF6D95E7A31F001
SHA-256:	5A2FE2BC4E619066404BAE87FD7D9A449054977D64F7D3825A8A63254070A07D
SHA-512:	9AFCA008708C0E389DD7443C8A10F651D1216D4B7134122B96645F73645CD7317C6266B7D30F586C253D87083973AFB006C0418A981FE7478A2ADB0CE373C3F2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...e.Xf.........." ..0................. ........... ..............................j.....`...@......@............... ...............................`...............2..HN...........H............................................................... ..H............text...H)... ..................... ..`.rsrc........`.......,..............@..@........................................H........(..P..............................................................-.~........-.~.........0...........-.r...ps....zr...p......%..o0......r=..p(.....%..o1....$....%..o..........%..o2....%..o4....%..o6....(......o8...,..(.....o8...o....(........(......(....../.rs..ps....z.(....,.ry..ps....z..}......}........0..Y........{....-7.{.....r...p.{.....$...(....s.......%.o......s ...}.......{....o!.....,..s......F.{....%-.&("...r.(.....-.r...ps....z..}.....0..0.......~......{

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1096776
Entropy (8bit):	5.795453024854296
Encrypted:	false
SSDEEP:	24576:nH7Ek5BVh5Bsu0G179oVVmfLEq2aw+QUZT:H7Eds79oVVmfLEqNw+1F
MD5:	AD514AF0C57668FCEE3C7AAD08B398E8
SHA1:	8A1E7B31BF4C7784CDAF8497A73CEB5210A8FEF1
SHA-256:	37879DF89E78E89ADB33918C3CA4D0DF623CEB059057FA6A7FA828100D98F19F
SHA-512:	CC1905C4F7F48B727DA8FC240F641EB881D5C328496EB9ADA257EB09424FB761354C32F08760C60AB192F43575A28917B2C1262AC7E716C2B1A1A13E97297F22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..0..f............... ........... ...............................T....`...@......@............... ...............................................n..HN........................................................................... ..H............text....e... ...f.................. ..`.rsrc................h..............@..@........................................H...........H............................................................0..%.......~.....r...po2...~3....~3....~3.....sM...}.....{....9.....{....oZ...,.~....r3..pr...po4.....}....+h..{....sd...}....~....r...pr...po4....(5......{....(...+...{....(...+.~....r...pr...po4.....o......o.....X.~......r...po7....D.~3...(8...,..(9...&.~3...(8...,..(9...&.~3...(8...,..(9...&.(:...&.........."..........."....D......(;....(...+.....*.0..C........o......o......,..oa...(=...,....o....+......o..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll.config

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	5.076136391837345
Encrypted:	false
SSDEEP:	12:TMHdGzNFF7ap+5v5OXrL/2/tFicYoKV7VirkTyxm:2duPF7NhOXrT2/H9kirkV
MD5:	ED080ED5825CF4893CA4F7D1395B9957
SHA1:	3905E190109E5DF90676F4716A69C815A6E52B44
SHA-256:	29F368DEF465F1AE30DF31EBCA4A976F180DBCF3718605B4ACB0D6DA95A30855
SHA-512:	73041863B7916B21A56D5C61933D9922D24B15548D7356DFEE42C3AB617F72A04AA8080F3C5EB3F21D968FFB38C7244D4484E78540BF6BB8FC93600A017E43D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/>.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0"/>.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8"/></startup></configuration>..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	295008
Entropy (8bit):	5.771512173166689
Encrypted:	false
SSDEEP:	6144:6ylhq4ugopeh5eBeGNx8cNe+zcee9eoedTeeIzeqRK0e6eR9pRFIEIEEICepM1Sj:2P4eR9pRFIEIEEICepM1S2LQQs1hP19x
MD5:	D3A3E82247F81342E217C92B9C89BC86
SHA1:	CBD914785348331AE68528ED71E317ECADDC10DE
SHA-256:	B39CA19017B8B99385A588433B4AA1CC87DDE272DA14771A9750F00605D31091
SHA-512:	EE5968A216BD402632A0CA1073B8C4CA5303CF28F30002AAAF2E7590B565FA3BF951E7B62320E4E3592DE50B9F56F08ECADCF67B50659DF056BB5812388A962D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....].a.........." ..0.............H... ...`....... ...............................b....@..................................G..O....`...............2..`N...........F............................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................G......H.......L9.......................F.......................................0..G.........((...}.......}.......}.......}.......}......\|......(...+..\|....(.....0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......rZ..p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....*.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45152
Entropy (8bit):	6.663371468091526
Encrypted:	false
SSDEEP:	768:iTFfTl1XWYTACPHZDgcE05P4Jjrnh2jwSosuTv1JKa5/Zi/6LsubsOzMnXbD9zMz:iTFbHXLPHZDgcE05P4JjrnawSosu71Jh
MD5:	F86AFF1B72BF70884B4BE0CA38919369
SHA1:	8D3DDF77DE94F5EAE244AD09F9D2ADDCC2DEF709
SHA-256:	69B2BBF16659F98D589942A1A3F344550DD1E03446DF4F81DC4668F1D51CFEC0
SHA-512:	718F629F907EDFADFFCBCA135DB6153B2BE001E450940722B43C16279CF9ED0A6384D1205D3287F397B2E8FCD9A5615BB2497E8717B6CF6391EFADF1BB122480
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...03............" ..0..X...........v... ........... ...............................B....`..................................u..O....................b..`N...........t..8............................................ ............... ..H............text...$V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............`..............@..B.................v......H........3..T=..........(q..@...ht........................................(......{....>..}......}......{....>..}......}......{....>..}......}......{....-%..(.....(......(......s....(....}.....{......#.......?}.....(....}.....(.....(S......(..... . ...(......,..(....,..(....,...(.....{....,..{....o......( ...*.0..>.........( .....}............s!...("...........s!...(#....{....,..{...........s!...o$....{....:.....(#......H...s%...o&....(#......G...s'...o(....(#......J

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50760
Entropy (8bit):	6.631383698123452
Encrypted:	false
SSDEEP:	1536:0X0t7C3ZK8wDP/ryEH0mBO4JjrDXaUfUPLkIFKKa5/Bi/hGvoAwWKSVdxxzXZVP/:0X0t23ZK8wDP/b0mBO4JjrDXaUfUPLkR
MD5:	04B900A20C71F7A23BEBA77F88B86308
SHA1:	C5BCD7AE974EBF89F6D12F26DBAA9B4FD4CF2A53
SHA-256:	BBA041B5BE0946EAEDE57AE31361844CA781C9FAE80607980465C7F2422F83BD
SHA-512:	F40B2ABAD653F4433D8B7C665D37000780D7A1289F4B187F8B51CA7C8D577C7D7449A5E12C0DCB1FBBFC45403437D6F9F4AD09CA326239C4D1823908063CE19F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............" ..0..p............... ........... ..............................8.....`.................................9...O....................x..HN..........d...8............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............v..............@..B................m.......H........;...M..............@............................................(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....6.t.....}......{....-%..(.....(......(......s....(....}.....{......0..........r...p.P...(.........(............s....s....(.........r1..p.P...(.........(............s....s....(.........rO..p.P...(.........(............s....s....(..........(.........{...."..}....&(.........{...."..}....*..0......

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	714312
Entropy (8bit):	5.981067761075983
Encrypted:	false
SSDEEP:	12288:H9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc30:H8m657w6ZBLmkitKqBCjC0PDgM5
MD5:	D473F50D1D29B975DA5B6EE0BE8DAA16
SHA1:	AAFC94D3C26041CCA3737FDF6240290DBAC1388C
SHA-256:	E57E1BD98CF3EB35B61BC5603DA893DD8018BE8CD6CC582D263CD964CE1E47DD
SHA-512:	1BB89EBE3EE9D61ECD194ED008C25733C5888FDBDE41A3D248161EE4A708526489A2F79D23EEE97CCAB0D58622ADDE158E07225B8A64AD1F6593CF848206FACC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ...............................Q....`.....................................O.......................HN.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{].....{_.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\OneAuth.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4255816
Entropy (8bit):	6.621144248265792
Encrypted:	false
SSDEEP:	49152:6vVaimCiynv9z1Rgzg5mHIZcAf8liK4B7sCIIcxiVztD4Up1ljWp3HGmhMhS+/Nt:64uz3gcmpXGmiMDTw5
MD5:	8E3C04EB2236C4CB93A631AEDC3EA9C8
SHA1:	B4E83AEDC2ED818705A0F2EA1C544943D0D830A5
SHA-256:	E9E25A64D404F38BF8DC6CFA94A80B7CC8C758A5E32CD671C57BA6F32D05BF63
SHA-512:	35F264538670B290DB473CA32E6400FCB3A3D4053180E61F4D49B8CE2D66C8C3C9AD30A60EFCB8D3A2CF1B6B7F75C34B648A52CD85B837E8F954A444543682E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........O..................R...................<..........................................................P......8...........Rich...................PE..d...y.Xf.........." .....z..H......0.&.......................................A......A...`A..........................................;.$.....;.......@.......=..r....@.HN....@.Pj....6.p.....................6.(.....6.8..................`.;......................text...\y......z................. ..`.rdata..............~*.............@..@.data........0<..`....<.............@....pdata...r....=..t...x=.............@..@.didat.......@@.......?.............@....msvcjmc!>...P@..@....?.............@....rsrc.........@......0@.............@..@.reloc..Pj....@..l...6@.............@..B........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\System.IdentityModel.Tokens.Jwt.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	94312
Entropy (8bit):	5.905204811037498
Encrypted:	false
SSDEEP:	1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gj:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0s
MD5:	A70D021C422B844D5B3708A619466057
SHA1:	5F63C78F20FA7E7ACA36C91F209D4215C854C90A
SHA-256:	5692B8A4E74EC8484A87D68379FC69FC119E980F79D2765F7FCA5BF5FA302024
SHA-512:	A8CDCC3043376A1D25B318739DB7545CCB0ED77C1E134CC03B5A009A655EA6861EE3E7246EBDFFA6D53B6BE31EBFFF93B34322488C1067712F0A280ED2B8ECB3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............" ..0.............*7... ...@....... ...............................-....`..................................6..O....@..............."..hN...`.......5..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......4_..0...................d5.......................................0..........s....%r...pr...po....%r...pr...po....%r ..pr,..po....%r...pr...po....%rG..prU..po....%r...pr...po....%re..prs..po....%r...prs..po....%r...pr...po....%r...pr...po....%r ..pr(..po....%r...pr...po....%r...pr...po....%r...pr...po....%r...pr...po....%rr..pr...po....%r...pr...po....%rN..prd..po....%r...pr...po....%r...pr...po....%r...pr...po....%r~..pr...po....%r...pr1..po....%r...pr...po....%rm..pr

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\System.Net.Http.Formatting.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189544
Entropy (8bit):	6.2575053993527705
Encrypted:	false
SSDEEP:	3072:MXWun8Jw8fCk/Dvf5eso7DpGbG8pwp2xuRLYs8jn4xo:MXWu8Jw4L/D3UVVGbGbd2
MD5:	8FBA542C86765B116FD3B6A397196984
SHA1:	47D65C9D0C0D07C4E76F3516C90E7FD1CEAC1B0B
SHA-256:	7E0C5104F49C2B79E0261BAB191CF7ED25BBE9C01BCB7DCEDAE5C6AA1F8BA94B
SHA-512:	89C05EFE882C226EB55A0D234BE49E2D4D639DB08FB0BF85129E672CE3773EFFA82E7F95EDB1F7DE1F3B8B57B38203AA69E8B84CB51885A9CE9918332DC06D22
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..[.........." ..0.................. ........... ...............................L....`.................................D...O.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................x.......H.......D...@............v...3..........................................R....s... ....(....F....s.....(....>.... ....(....*..0..d........(+....-.r...p(c...z.o,...-(r...p(...... ...%......(-...o.....(^...z.-.r...p(c...z.-.r...p(c...z.../.r1..p.............(g...z.o/...rG..p.o0...-'r...p(...... ...%..o/....%.rG..p.(^...z..o1...o2....>....rS..ps3......}.....o1...o4....+E.o5......s........s6.......o7....o8.....o7....o....o9......o:.....&...o$...-....,..o#.....(...+:.....o<...s

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\adal2-meetingaddin.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1769056
Entropy (8bit):	6.166747246802417
Encrypted:	false
SSDEEP:	24576:s5EOB1S6bxNZHY6vApo47bw0puGr7WH3TvKsUfWdZAujbC/:s5Ei1S6bvZYn20uGr7UTtdQ
MD5:	68489533091EA68287F7F777301585B3
SHA1:	4DF72C6058EAEC0595B3737703F75E452EB49704
SHA-256:	61B5650FAA6325CD16E3A65739017421043D618B122780C5905AA24A10122ACE
SHA-512:	D2297C8A14C44CFCD1E7F06C52E111A25DDAE050A76E72E14F6ED0FBB15D35DEB0ED4AC134D342FE9FA49CF4717177C1763BEE82A1FFA3AF3B7B06C62A4B3624
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......`..$...$...$...K../...K.....v......v......v.....K..3...K..%...K..9...$...H...M......M.....M..%...M.}.%...$...&...M..%...Rich$...........................PE..d....l.[.........." .................]..............................................i.....`A.........................................-..T...47..,.......8...............`N......0%..`...T.......................(....V............... ..x....,..`....................text............................... ..`.rdata..L:... ...<..................@..@.data........`.......P..............@....pdata..............................@..@.didat..0...........................@....rsrc...8...........................@..@.reloc..0%.......&..................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62536
Entropy (8bit):	6.619052550214228
Encrypted:	false
SSDEEP:	1536:KO9gSK8rih93rkkMy6HMyFPcIk9WvLdQWuB5X2PHJMK1SNahIg8DTuf3T11EikM/:T9gSK8rih93rkkMy6HMyFPcIk9WvLdQM
MD5:	918B2973A82BDA52C4AC8A09D2574E1C
SHA1:	40FF2FBFC9D48610CA8334696D0A8292E7F98B2A
SHA-256:	F43F46284EA5B51849A485A76D6435B37D830EDACE7C3FBD461703A24AD50CE4
SHA-512:	41098F24BD33E89F72D4A5F4A2F07D9330C57CD36EADC7DEDB1F793C7C893C231320033BF87E28197EAD74667636444530180C57C78A4E9EE68575B86D285E3E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..o...................................................k..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65640
Entropy (8bit):	6.573404012365602
Encrypted:	false
SSDEEP:	1536:6O9nxMvE5lU94Zs+uNQGChcfaEt5tHBB8spapY1KCcLJIaSgN8AzlaGEikcwsLzv:D9nxMs5lU94Zs+uNQGChcfaEt5tHBB8/
MD5:	EB05AC049255AEC7D000FF9164B5C579
SHA1:	8CDB9A4576EA58DD1C10F6E3426A01CDFF5E7E6A
SHA-256:	ACF1548E834F32D5AC15B7B2393CA55C098F160222052B0EBF9BBB6B86E13DF0
SHA-512:	20DEB44D7785D22B5B5787B5640D063DB48E4CB68C3B719C04B9E1BCA21AAAF46F471E6A580DB7C521A98BF2000D2FB02F89E14E81DBC3F18F4FF0600B527BEA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................08....@...@......@............... ..................................................hN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ......................................................}..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.4892523851181485
Encrypted:	false
SSDEEP:	1536:3O9PKsQZAjb+f5g3GTGw9dLFqH78Iu3vwUT/aDXeX3iqeVQkiO7imZOEikxgsmzG:e9PKsQZAjb+f5g3GTGw9dLFqH78Iu3vU
MD5:	0042BCE2705220E9992DADEB9725B4B6
SHA1:	AA3403D14D626E96BFA25807D437AFB70874B7BA
SHA-256:	48BA5EB4C48A09339870E676668D46F1A91A12C7DD362C571B0DF8898245665E
SHA-512:	61083CE34048F15D7737670F27551822C4ABC84A0021CEFE2942A35C5BBD88A27DD85A6678ED6377F8F041A3002AABA8D7C40623C2733365AAF7A17CF5C5633F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................:.....@...@......@............... ..................................................HN........................................................................... ..H............text...`.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..6...................................................2..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.561446350526192
Encrypted:	false
SSDEEP:	1536:/O9CKHHlgdQ4L2QSW6YEcNHuSlMGtrVSL4rOeqDuseAT8HNQ3spEik2wsezBlZAv:G9CKHHlgdQ4L2QSW6YEcNHuSlMGtrVSq
MD5:	8CD85487C33E93419C0B4DEF6256DE5F
SHA1:	C1B6735FB85B9CD557E16286ADC0842302394445
SHA-256:	CCCEDB9A5C9E8962EAA1AE49336911FE9B38402A77EB6F402C2E4CBD93C71887
SHA-512:	C221DECA3F0C69C6D25F8709AA2501090CF5FE113D1764BA39D7EBD8EC9C1C1B281A8D20F586AD6F52BE17BDAFD58AF85BFF034592FE2A3F6EC4BB7F600F6B0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................S.....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..k...................................................g..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.521529157814906
Encrypted:	false
SSDEEP:	1536:kO9ADi+BGe+Yj+fEligSKm9qI32i3loAECsedjllekCRf4FwpL6pTgskpEikhQsS:R9ADi+BGe+Yj+fEligSKm9qI32i3loAa
MD5:	E30390D70C3D4089E674A6A1E953AE77
SHA1:	5AAA7EC14E8BF4FAB1BDE339C67E97D0D5BAEF4A
SHA-256:	D48E430A4641A2659F425E07EE20F1B7047A958AB3500204315E681F98712199
SHA-512:	9E1755C9B874CAB0B7375700289535BF39303275F4AB46DD4B2694D8C4CB8EEA93C0F4ECB267D419F9A43C69B3DA7654425867836066A16494A80A11470727B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................K7....@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\da-DK\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59488
Entropy (8bit):	6.519135032255633
Encrypted:	false
SSDEEP:	1536:8O9Nhjxn9FWv4GByP5KpHSnLbM9B5vBmGOv0/kOeR/1OgBly2bCx4EikxgsCC4dj:p9NhjV9FWv4GByP5KpHSnLbM9B5vBmGE
MD5:	69361950F536EFCB3345972BD44A788B
SHA1:	11AAD570C143AB9C2A3FFB9D8F12D6C7376B8291
SHA-256:	4778D0F95106388141E524649B5E9D365626A1F00A522D6F0187B4413E633021
SHA-512:	024965A5B9FA7451188C4EF63E95840AAE9122935DF35538653C2E66DCEBA40C8DC77686761AD53FFE25AFC1479ECCF5105A551E11BA2D80A9C88CC5EE929235
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ...................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\de-DE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.501050121893406
Encrypted:	false
SSDEEP:	1536:6O9P3k0b/0/IDJaXmsl/+ToOLWiXp3n4bydq5inL+yPocyx+q92nYHYHzB2iHG36:D9P3k0b/0/IDJaXmsl/+ToOLWiXp3n4k
MD5:	82C5114A1BFAF242A09136EC943B30F3
SHA1:	0CD51F2771F1B6F12F770C510B1A491177334CD2
SHA-256:	665981F1234BFAD8C0108D1C7ECF5097C2EC918D9F164A4B7F8269A43C55917A
SHA-512:	FC8638592A7FE0114B8948ED4FB3EE9EDDC20AEFA16C8741D8A706E7A2CC8186E50EBD7E530D1320AD9A80A2A9757CA36140BF3EE4DDD03D0D33A87078783820
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\el-GR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66632
Entropy (8bit):	6.59091502517811
Encrypted:	false
SSDEEP:	1536:+O9OCfiY82Whhf/Oaxtz9dgqn1LsIOYCZx/QxJHDv+sBkzKJMPYBj8UHNDoEikcj:X9OCff82Whhf/Oaxtz9dgqn1LsIOYCZV
MD5:	7FE494D6AF0B9325257186DB2F2A5B3C
SHA1:	B1BDD6D3156FB5BE8CC7C0FEC22F85DF8F5F3887
SHA-256:	DE2284A8BCBFE4B747AE0A53BFB8055791BB2AC63661581C76278674199A05DA
SHA-512:	0149FC3ADBCAEE5C710EF05E3B56D5C39577213708485BA045FA3F8223757B7078327B080932593839548DF46481CC506898A4DF63A9F92E3CF650237EAED992
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\en-GB\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58976
Entropy (8bit):	6.513267731001312
Encrypted:	false
SSDEEP:	1536:ZO9jlXq39V7UTJazmvWyBmehkkSgwgt7pK1Iq6lDRyFxutpLdcIkey5ZvEikNQsP:k9jlXq39V7UTJazmvWyBmehkkSgwgt7j
MD5:	A35042A4DBD03ECE06C1E77A060ABC61
SHA1:	F854516FA8503BBC42AE13D484548B82D298642B
SHA-256:	373857D0601291C5A931F24E44C55DA79E8ECD6D20FC1F747001F3CC07373D60
SHA-512:	3996ADA54AEEA1C1C83535E5D7CA3269340DD7F944DE8B92E274A808350DC513683EDA368135814A9DBE1133A0238A34557DEDD98C9921AE364E9A95EF87C026
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................u.....@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\es-ES\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.497159783858232
Encrypted:	false
SSDEEP:	1536:YO9PcsKNcG6/SfNsIpERGRBPvJV50ATCaHC1B4/QYfsueQ5amCVBjEik7Qslz0ZW:l9PcsKNn6/SfNsIpERGRBPvJV50ATCal
MD5:	2204315EF94FB761A9881358A5E76A24
SHA1:	23AA21968A31225F55DDDD05786AE3229C034721
SHA-256:	790BDA84F8558D880F31BE0D2623BF91B042FB887DE7BC34838B2A7B2F809E84
SHA-512:	6C85AE675793BC5692310076C70BFA6E58FC58485FFC3E61815CEA124732B5C70C63C9385E6906F8296274FF021EA4C97E4ECF74CFEA6417438C74747A2864DF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................#....@...@......@............... ..................................................HN........................................................................... ..H............text...\|.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..S...................................................O..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\es-MX\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.496671021509118
Encrypted:	false
SSDEEP:	1536:IO9PcsAbAUxcRLSpEebIfb5lG2vuq9o7UtIbQrZuGl2v/+/UAsO8jEikKAsNzrZL:V9PcsAbAUxcRLSpEebIfb5lG2vuq9sU0
MD5:	D55D270FDAA1438E86CB88A50D14307F
SHA1:	A263D5CC55A46E6425BCE9755EAB5C71CB130015
SHA-256:	E043A91947011D2A147E65CDB2740632D823E16D41972C0FEFA5E8292CE2404B
SHA-512:	EC83C29D02D75167562E7B7258FB522DD6A6F37C813F71E265F9D59610F5BC3886965647806F7E58D75F48F3646101657B5CEAD58093DB51A58802C727706F2B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................q....@...@......@............... ..................................................HN........................................................................... ..H............text...8.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......`...............P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\et-EE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.518455229340612
Encrypted:	false
SSDEEP:	1536:YO9pDyWBFils6mKaFq1ZU7iPZn3VfrsYaInkpxOM8zrBwl0xvWbiLv8LEikkwsO8:l9pDyWBFils6mKaFq1ZU7iPZn3VfrsYo
MD5:	C9A8FE2E0F679F8463B88547C27255DD
SHA1:	C3AACD5338702F76A1BBE8577601850AE96FBEC4
SHA-256:	25D3804E16CAF591F113CF8F88FDCC2C7B0FE2CC86F6E443B0FB3B87E3D9B5D1
SHA-512:	2DE3028BB76C51E15ED96BC6654C0E8B14548BADB45AEB3719704B51B7532D7CCB4D87CE21C5ADEF5A1E9A50B356F9D4A64BC46EEE9DF61AC46296C1CE07300B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................i....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..Z...................................................V..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59976
Entropy (8bit):	6.5124724749609975
Encrypted:	false
SSDEEP:	1536:vO9WHroG73/MBcBgbQtAIceIZJA4qErCGAqNDEvu/XcgKErjRfxLzqkXzEikrgsg:29WHroG73/MBcBgbQtAIceIZJA4qErCU
MD5:	A101FD35F9452436479CBC0569AF5F0F
SHA1:	A8270B69B7D54BECD4814E8436AA316EC96D397B
SHA-256:	6A8A99D5DC4CB1A0F62D87F8558C6ACF375DE8D696C46920A5FD400B3841D4E0
SHA-512:	422C3989345E5E343205433E5709135573ED50AE18DBAC33F9A898E2CDDA65A2CE53DF9A774CF6CF92650057E8BB049B30DAF8216D263507FC20B18357E8959F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..V...................................................R..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.501505785175988
Encrypted:	false
SSDEEP:	1536:9O9ADK9GGZoFZbcS0PFl8SJiJS4+X2uMd0dSBb/yNvd1SiUU/GpgYCv1Ny7iwEi1:I9ADK9GGZoFZbcS0PFl8SJiJS4+X2uMD
MD5:	43EBF6698E8ED6E57A8A3FB079F718CE
SHA1:	D282791F153159EE4093CB2424DC52C2E334BB40
SHA-256:	A3A951E4BED1FD9F001A20886878980EDCCA336CC50054B1C9CDE99A2D2F2533
SHA-512:	0111ECFA04BE397A235F2F1549046831577676F90984F34B1919AD1B8B6CA5D8DCA8FCA5650DB99B85253997BA95D6971B43650BB29781EE64BA79B2434EB096
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................W.....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.507124752707679
Encrypted:	false
SSDEEP:	1536:XO9ADl++Qh8hF3dLNbJZIeiVFbdQ9cBxIjfwjRGaDZng/7HXwpJjAvvhYpvvFi/N:+9ADl++Qh8hF3dLNbJZIeiVFbdQ9cBxq
MD5:	B500AD907A9F4E95314179A34DEC75E7
SHA1:	DA22B47E32D7DE1D8BECACF2392CEF47D3460977
SHA-256:	893EF5FEBF0F7118E4E7A6EF18A521C6A85A390FBDBB03E19754E83A60841945
SHA-512:	4C88E4975E5A375FD8E958B57BC400796540CE80F9B393C77624C0652BEA26B113AF9136B43FD2B7C5BCBEB5382E73EA93743B8F58DB3BE022921B52E2204F55
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\he-IL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62024
Entropy (8bit):	6.56914871344235
Encrypted:	false
SSDEEP:	1536:lO9CElFACr31NvYOv0ffLE2WGNFzw9mgCOppcdIUX/a9BcPF4O9M6XPfEik2BQs+:w9CElFACr31NvYOv0ffLE2WGNFzw9mgX
MD5:	4BDBF1DBA1B7B321E15265EE6D7E7195
SHA1:	53708179AABE57782275FDDBD5DC03133CF3FE13
SHA-256:	A880CBAB569A1A1B79FDD0BF22AABEB970ACD52B7F8DEF9930C8FEA4F2119888
SHA-512:	D825BC8A138E5C70FE7E3FC242DE5E03C653C6CD5A97E9D26B29B1294ACD4A74FFD9CA8A3E31B33936A390DFC4E4CB630EC3FD055AADB6CF6BEF9EE958124377
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P ..q...................................................m..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.500655599661843
Encrypted:	false
SSDEEP:	1536:nO9dO2GxyJQPMKJUlRKXQu+aOdD68/8aEv8Fez74mwBxG211H/KqIG1EikRAs/zN:O9dO2GxyJQPMKJUlRKXQu+aOdD68/8a6
MD5:	A17F101F048C7E157FE53D6C533D298D
SHA1:	D3D3D09BBBF7269A269368818A039E7EA5779CD9
SHA-256:	FC5560A78421EB40350F57221995647C8136156ECC81A8A8E9C1081FD07FF038
SHA-512:	F79F07492674C88AC76EF3966C38BC5C7C1A2190A6A5778B5ACACEB8130476FBE7C48C8CC3182663ADC61FCD4BF0C3342EA7CD2147BC6D87B449280F5B93B8E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..^...................................................Z..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61032
Entropy (8bit):	6.545333848393183
Encrypted:	false
SSDEEP:	1536:5O9PebzfDSD12NfIBLCOP8mTtzDd0Wx4Ky6Vlm3KlbcGUYTo1f8Q8ZOQXOQ8M0Qb:E9PebzfDSD12NfIBLCOP8mTtzDd0Wx4i
MD5:	E3C3CD6A7D0B5BE8FDAB1353EC88E841
SHA1:	25F66AE84F3804709441812F9148CC3638F44ED9
SHA-256:	147FC977F5955EE8ADBD02DE361444D7EA76AA52C3F376E817D0031A1798586D
SHA-512:	0740D73B3E3AE434119A852DBE23295407547CC45A015B5C41E32AE7D2F9681A8681D6BA30224D8812693B2EE6A8C33C28C0B9A6E1EF6305CCCEDE435FC07898
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................hN........................................................................... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......P...............P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\id-ID\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.487928672817359
Encrypted:	false
SSDEEP:	1536:zO9NagPURiGTqSzcnYzsdxAeetb2YHEKTtWA16o3vPjBjtLP7bUcEikkHwsMzEZv:a9NagPURiGTqSzcnYzsdxAeetb2YHEK5
MD5:	E63026CCA00C40945973E40C060537D0
SHA1:	0B734DE1E644FCA3B91817956079187F107B88CB
SHA-256:	8AF427016925C688B075C8E6621F8141B6CD47C585CD2AEB1E6029F27BE881C7
SHA-512:	73CF03C490732D18E94A0076FC3F4ED0B3E20B9FCFB46BB8AEB3FC25F7D3AE38EFE51229170567BC8735AA986A49D4FD06417EA66DE5BF48106AEB50992414BA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................Ga....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......,...............P ...................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\is-IS\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59976
Entropy (8bit):	6.531167197804544
Encrypted:	false
SSDEEP:	1536:aO9WAqYD97mcB1jaIJB8E3rTYSXxVG12uonduxkeU+BJRUJsQVr1q4EikrkwsOzf:j9WAqa97mcB1jaIJBP3rTYSXxVG12uow
MD5:	00F47F64738E11F38F72C6C82FCB84E1
SHA1:	1F55D1C6BF1378CA0E8B564E248C2483A59FA07A
SHA-256:	49CBA0B6AC65DB3176B850D610055A6F0897F121E1DD6FEAC1F419986627AE24
SHA-512:	1B586222146E4897E9B3DF351E9AAFAC4C80958629F1D255225C265B90F7DAEB4DDD9273E8944E08D19BD6278AE49A650B2042F9A7C2D62193131F1C31392883
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................t....@...@......@............... ..................................................HN........................................................................... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......l...............P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\it-IT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.471403653759095
Encrypted:	false
SSDEEP:	1536:sO9P3y5h0Fp0NK/gRcFvoZ4FKKC2msifHLrEvI2UzpCwqPZHas2dyHrWEikrQws3:Z9P3y5h0Fp0NK/gRcFvoZ4sKC2msifHf
MD5:	7024B9BB3F91080CE12B744352561DBF
SHA1:	C971444A6DF7F332FDFED322F764DB15EBD398CB
SHA-256:	4037E573F2D03C612B1A18EC231B66291722096B9CA9BF5B9EA6387EBFEDEE35
SHA-512:	45B4CFFAF77FCA07DEC8EEFFDE6B43BF1F1D54FFE16C66A7F2002E89520CE412243844AE275A01218A7C0767339467731420920C4C943574AB3A6D52919BB6A9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................n....@...@......@............... ..................................................HN........................................................................... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......\|...............P ..+...................................................'..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62048
Entropy (8bit):	6.68305367310075
Encrypted:	false
SSDEEP:	1536:EO9WeuzR+bLcQmuGuRuBG6v7yM5uGJ0HIc2N37cRAoXDuII5ZCUaRvEikkgsRzzP:x9Weud+bLcQmuGuRuBG6v7yM5uGJ0HI4
MD5:	07440CAE8E6B27E2BC26386AFDDB70B6
SHA1:	76084A1A6A5B8BF6BC688B0D88228F422AC07144
SHA-256:	1EED650838D7C0BBEBDB83A1B8D9997D2012FA6E1304E2B7BA6828AF6115F3CC
SHA-512:	C759918FF36CEAA7F1F9F4FF22D1AD578E1DE997E0FEFFA005801693815E2F8D1E5200B1975BF4711D5A20067FF72E31B180A504F927E80F82F5F9BF1FFAAF86
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.6739946564864026
Encrypted:	false
SSDEEP:	1536:hO9WAqhvGiu7WCbAfU8Uvg2LKhiM3fYzsKNLz89SghOD/4Ke5XzjEikwQAsAzyZO:s9WAqhvGiu7WCbAfU8Uvg2LKhiM3fYzU
MD5:	356873E063BD208A4D216D5276990B49
SHA1:	78CBEE7DD690AB66760388D5334C4A4EABE95438
SHA-256:	D583A30A4C38711ECF4CE369D153994297705086E264C5D083A0D9BDF016F980
SHA-512:	EFBDBEB5569BBEC794D259263129246DD125CE338D2C7225D3DCDFF8BE5685F8D035C567C6E9C78740C7DB7610D1F423D55CC5B12E8F9859A6F1581119F1D392
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ............................../.....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......0...............P ....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.537260960859277
Encrypted:	false
SSDEEP:	1536:vO9B5vAqvshLrR3gUZO2A9oclmD1tdDnpRmtQH2QKDTLXosU2ex+nuYEZEikg9gd:29B5vfvshLrR3gUZO2A9oclmD1tdDnpe
MD5:	D02761F132672E5B23C669A12FECDEE8
SHA1:	4EDE1CDC961CB562E26D895304EA15DC7861F909
SHA-256:	37B47B96EF781DC85D7D16AF45E9CCBECC621BFB8829F3E7F5675DCF30787C0D
SHA-512:	0B896B49011A6292ACCBA5A2C2E6AEF9144889A9EB57E37C55AFB2DC11C861FCBCD363C05833F1F3D9E3DF70CD77CBDB5022A1D8AE1B56DD2050C2EF46027251
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................@f....@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.550250140012729
Encrypted:	false
SSDEEP:	1536:NO9jvyffWGiHpdYq84Ae89YJTrjz46UNhNnkGzColMa9TJERMCx+Eik0QsAz6iAY:Y9jvyffWGiHpdYq84Ae89YJTrjz46UNu
MD5:	3144EB325CF91713A398CADF793050CC
SHA1:	DF26539AD41F2616F7B19A852058AE1057955CA7
SHA-256:	79994B09E068AF6A30EAD314DCF59D0DD0F76AFB628108CBFB20667EF04487DB
SHA-512:	BFC3BC6AC117435C1F2ACF94417368873502C3DFF6C838273E3BD8D91C394769F2390CA3766FC241CF2533E6593609606272CBF0413ABC75435F1A9AAE4DF2C4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................^.....@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	575080
Entropy (8bit):	6.521129188359906
Encrypted:	false
SSDEEP:	12288:VUfve/yP6vdqumz2etG5ePx2Fl5/G3XLSNuDaQEKZm+jWodEEVfKF:VPbl9G32UDaQEKZm+jWodEEBKF
MD5:	80B9E0B8F82ED4FA77504E8542474E62
SHA1:	7A1AB5E2469F66DBB55AA559EEABC802718AB5DB
SHA-256:	48E9CB77BFCC210DA6908410C9D604EE5401DAAFCD18A6EDC8028FFE2296CC0B
SHA-512:	EFA6D3B877E4809E4EA0903EDA6D500E7227EB5FE034163D3E9299CCADAFB41B2D42E5CB00B015F3BFF46BB302DFC9789E8F60C020D1E8C61817D4F47DC6B9DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................s........9.......X..N......N......N......N......N......N.U....N......Rich...................PE..d...c%.`.........." .....8...Z......0$...............................................Z....`A.........................................2..h...X...,............p...9...x..hN......0.......T..............................8............P...............................text...L6.......8.................. ..`.rdata.......P.......<..............@..@.data...p:...0......................@....pdata...9...p...:...0..............@..@.rsrc................j..............@..@.reloc..0............n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.506596897827211
Encrypted:	false
SSDEEP:	1536:rO9NAXZqHGnAfUPOMnwjxNK0/84Z1aBBX2dulK0rEyKpFbFK0qA5n0EikpAs9tEJ:y9NAXZqHGnAfUPOMnwjxNK0/84Z1aBBN
MD5:	EB594ED6AAC282A630EC76A6C666568B
SHA1:	CC9405D539AF74D6CBB2907169179B32E2E645D0
SHA-256:	71BAE7FCF4BB8A311A91283AA248782C844D9227DB6E1FE04E48A4CAB14AC526
SHA-512:	BD31CC0E98DA09876A79C0FAC14C0C196AFF161E96765B4AB347208AE11C4E19BAB15D270C319F3ADE3D8B00FC11946DFDCCF6BF2783F44D9E663895017FEFF6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................=....@...@......@............... ..................................................HN........................................................................... ..H............text...h.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..@...................................................<..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60512
Entropy (8bit):	6.489311459832048
Encrypted:	false
SSDEEP:	1536:WO9PR9q4u0ayE7tbVTGDyl5lr41AcUV3tbUe1FdFYWssYYzTRo+0W+zmtq6+D+rn:v9PR9q4u0ayE7tbVTGDyl5lr41AcUV3L
MD5:	BD45CE1BBD7F5130195DBD73AD56E606
SHA1:	5A817D3AF42A2354FC668BCD4FDFCE0DA0D35570
SHA-256:	D02D2FF4F09DDAF6037396B99D25FB1FAED784C6C4CC2170D148E837394BDB52
SHA-512:	64478405C87E625E4870A6ACC183625BD8DDE212B2A09A71A7A6E37C2849296D74A70A1E3C4AB09118BA2C800591B820AA842251CBF2DF87EE8FC99009028976
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................aa....@...@......@............... ..................................................`N........................................................................... ..H............text...P.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......x...............P ..&..................................................."..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.514600219985342
Encrypted:	false
SSDEEP:	1536:MO9NlqiUFxfhZjVqvA/hIlCsOdLM0SB3b6RCJmwc3fF1p3Ruoh9lF7+TmuB/BYSw:59NlqiUFxfhZjVqvA/hIlCsOdLM0SB3w
MD5:	DB3654FF3F605626B6DCD8FAFC855E1D
SHA1:	2438FABB623F8DB213E12B483C050FDC2AC71567
SHA-256:	BAB4A85FD4251CCA4F6DFDE973396CA574D320BA0007BAFB5BAC6617082CD1FD
SHA-512:	24E47F36164742E83DFC58F3C08B1BEA712C92BF51281E2ED310010DAA0028286BEDBD1B9DF4DC6EBA4E77E62A23CECA45128851EDB0FDA222520C67B50AD0AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................j.....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.5286663954726745
Encrypted:	false
SSDEEP:	1536:tO9YM3z1nR8zMuKIJycvcygytrpu8hYGNNxYjEF9dmPTKgMsGRissxEikiQsjzpp:49YM3z1nazMuKIJycvcygytrpu8hYGNW
MD5:	2F6D6BF4F97F9FDF61FE4B9247665AC7
SHA1:	30B23726BB0006AC28DDB0D5D2E0B7936D50263C
SHA-256:	C617711C87A7202A62275AAED8BE5CB7BF5EE8AB6C12B18A830B22653D44F1FF
SHA-512:	2F74D1A5003E8F8CF504AAC062BC9F7FA1BFD1E846F8E02DAA5CA6991D576755D83C0B14F90F1BBF6DBDF4B85F5DF945FA4A13DC849982A8BFC31130C6870273
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..b...................................................^..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.512637538205462
Encrypted:	false
SSDEEP:	1536:9O9PD+Ztk6ONWg3iynOs5U1jkFhKwKH/PIPq7tzZtq93YcZ8+gGRlEikIQsVzvAf:I9PD+Ztk6ONWg3iynOs5U1jkFhKwKH/T
MD5:	8C9EB5AFF7D0004D30947C194E25ECC2
SHA1:	959EB3185D0466563B5ACF81D523E66B2159E343
SHA-256:	B99AAD3F2F2318CDD199582B671BC3DC3B3FC6EED93B58197A08EE4DC4F3B9D8
SHA-512:	3052152934E817301E4F9A5B53A025F659BA736895BDB1B5F477F338D4F50DF7E98ABF4F11AE3E7DF614F57B9718A66FD62E44FBA34C4C09F557FA0C8631B12A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................D.....@...@......@............... ..................................................`N........................................................................... ..H............text...\|.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..Q...................................................M..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.492692129735815
Encrypted:	false
SSDEEP:	1536:qO9P3hKCp6OYLZur7K/Wwtzx9RA8YGsBo4bUxOhTeiuQKYGasX2qBEikWwsBspz4:z9P3hKCp6OYLZuXK/Wwtzx9RA8YGsBo5
MD5:	8D810F97C5E04EA5CC87E2C8044D6DF3
SHA1:	80C1EF7C2F54626C96B6B192662FEE0CC0551B84
SHA-256:	D45D72FA2F69646E368DFE35F4796AC0CBF81B1820F5CAA33B15BBD6D9CAFE00
SHA-512:	98FDD764AA6682A6AE434D1FE7202F6E2E776FED3142E4AF069704D05CE35EEC1C0B40BD8210BDE309A3DA1E2C2A2ADEA5D377F71065472EF4C760D434421051
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................n.....@...@......@............... ..................................................HN........................................................................... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..K...................................................G..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.5227816765189095
Encrypted:	false
SSDEEP:	1536:aO9PchEfYkIl57Dr3w8Zw9XS+xd2XHsdlEhm5AtmxhG7TcFzCQOnwxEikrgsmZzp:j9PchEfYkIl57Dr3w8Zw9XS+xd2XHsdx
MD5:	BC13EA7F2F6C6488B93EE84A12A5C67E
SHA1:	128393D9F9B3D6E6C14232620FBAE67AAB45FE55
SHA-256:	29D108F22CE4B6AA310AFF0420DDBE6F085381F4EC5E208E1106C9667CBD8694
SHA-512:	38C7289F2D367D29DB10ADFBFAC21BE26287100CA6F34285B63A3B701694088603192890750BD0DAC5171738C7C1E47AA0A8A2360E7682271695973CDBBC7742
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64584
Entropy (8bit):	6.607514539190837
Encrypted:	false
SSDEEP:	1536:nO9MFcYvxELwVgZIvKsk24cxu1XVwNCMRTid1j2rIgfdqI5TOfHtUI8EikGGLwsV:O9MFcYvxELwVgZIvKsk24cxu1XVwNCMQ
MD5:	5EE803D67F4C341073334A062DCEAEB0
SHA1:	B09E00E0BE185271E40488C9F1C6C4FF407B8C76
SHA-256:	FF8565E4040DFD48EA209456DD7C54F92CC171F3FAEE6235B366B8B8FC14AED2
SHA-512:	C21FDE21097FD9E7E82CBC6F726D2CFBBE3D2B97132AEF6812CF33BA3BD856BDB86EEC504971BB6E2FCDD91A84F4BBC936BE8E02611ADC32E2C79F7A383DF753
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..a...................................................]..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\runtimes\win-x64\native\WebView2Loader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	151144
Entropy (8bit):	6.290559037571387
Encrypted:	false
SSDEEP:	3072:X/bzlLd3z9vuTuKTVFfXaRg2eslTqEtBOx31dlEEW:td3z0qKRRX9Etee
MD5:	AAFD0A37DD5E306CE6C049D998DF1ABE
SHA1:	C1E60170F45B5FEC06A2708DBE92D6A0EA79F828
SHA-256:	6D4E45818E68B910A35EE49076B7C058795BA0AC06AB9D4F9AE39B72B13A0292
SHA-512:	C4D023CD37EF87C2DD2EC10B996D055E3B9A52CC5EE0AD555CCF5765D2BE1EAC99E647CB975204E3B4C70D776CE5A35E65956ABDAAFAE00600FA89D5FF625D40
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......a.........." ................`@...............................................^....`A....................................................(....`..................hN...p......d...8.......................(....1..8...........`.......(...`....................text...e........................... ..`.rdata..<....0....... ..............@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.tls.........0......................@....voltbl.>....@.........................._RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.55399526567631
Encrypted:	false
SSDEEP:	1536:frO9gebhHq+ugsPXU6d/ic7SFgw0FAAgWwUT/8IS5RhOYPi5wt7DnTEikDwsQC45:a9gebhHq+ugsPXU6d/ic7SFgw0FAAgWK
MD5:	B04010BB25B1AC49817595E2FEEB6267
SHA1:	DCBDA104C5112E60BD0CE07D114DFDF03A5445B8
SHA-256:	1DACFA2C3100EB9D635E5D6DB5E4F72B451F0175712F62169D3877C454F15B0D
SHA-512:	BCA41D6247A724AC8FFA11A1E6108469DE22EF6B71EB679666C680FB347E1A23FFB5522C8C5E69D061F75C2767E9EC1CED6F8C62814F06497D7FE31EC27D31BD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................m....@...@......@............... ..................................................`N........................................................................... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..K...................................................G..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.5077376831024445
Encrypted:	false
SSDEEP:	1536:5O9mF2xWvZr5ttPBV5ramm5IgejsnMniPqhm+HFZUI8L0CmJ67V86o1/7EikS+Al:E9mF2xWvZr5ttPBV5ramm5IgejsnMnim
MD5:	04D6237AAF39CC1B60A8DDEEDCB8B118
SHA1:	81D860BD18C4BC020ECC2C794EE3610FD2DB6F0C
SHA-256:	263411C49C7138CD813093CA7BE23A01F8B7934BED41133DDF5838CBF47EA2FC
SHA-512:	9E775EC5F197921632E9D65D2F25A83F8FD25EFFC3381D6816C3A8A256C28B3C485491D3E20749E4F962EC36D567E0F080FAE2992A60A5571BC580E647E235EF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..^...................................................Z..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.509192080147688
Encrypted:	false
SSDEEP:	1536:uO9ADvQ094ML8I+w2zbtseqNaio1KHc4hUyFE4RlxgCwXVn03mO0OHk0Eikogse7:H9ADvQ094ML8I+w2zbtseqNaio1KHc4q
MD5:	AEEC00A83C3FBA182F9A931A0A0C7F2F
SHA1:	4FEF5D8CFC73550A92036CA984360871E2272721
SHA-256:	651DCA613FB0141E7A0AA256D5856F6114073B344A91A614E68B1DF1F87C887A
SHA-512:	D54DC3B0FF39C213ED771481441C3C7D689F457A6632BB4BE38DC50EBE3970F6CB7697A535AE8296A5789253720A229ABAF2A2129FA4577535E257E1A3829D78
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.533113744944594
Encrypted:	false
SSDEEP:	1536:xO9NbIMAwsK92xi/p6ZCXczFy597Zh3ndpqW7A7MlN9XXW0LlTcE56HvEikDQsrA:89NbIMAwsK92xi/p6ZCXczFy597Zh3ng
MD5:	FF9ECD9B097075575B6B0B71FE7C8431
SHA1:	C1D67459FCF36A5DE54FA88A8195F9A41F4F7E09
SHA-256:	F18142E0B49C0BBA9E3F16C45179E5F86372C0EA9199CEB6F95875352ADE5EAD
SHA-512:	CA32500A21F91762C3C8E8C3935C493D780262E5E5DA27E031A7DD1BB410E5E5774202BA1DB4BC7321B5BC64310E1F4F53E31C84FE38937DE1B1CAB6FA8EA5F7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................T.....@...@......@............... ..................................................HN........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\th-TH\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69224
Entropy (8bit):	6.490605086681413
Encrypted:	false
SSDEEP:	1536:QO9f4A05v/3yGE0k4otwhknztUWCH34BsBrs+9XgaCTK6pO3/SNmKWREikrwsmzA:99f4A0533yGE0k4otwhknztUWCH34Bsi
MD5:	3E5B1BCE67D4B752BA5C5849DFAB2500
SHA1:	070C92D43E04F7FE17E617B7885D0E4DA09CFDDF
SHA-256:	6DA0C2FA24300190CBE93EDD1EE7D9D1BAEAAE5FE4E41485FA9928F93190FF63
SHA-512:	9D4A640F9C9D1FC8F1402024F1080BA2BB669BB0522313BCE8D4E9BFD136DED3EB11447866F1856487DF6FA407FBA072D7D7B29F0FC538E7EE676775DDA69B9A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................A....@...@......@............... ..................................................hN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60512
Entropy (8bit):	6.536989118356474
Encrypted:	false
SSDEEP:	1536:5O9gSA64YW8K4MZQ00EOS4Lhq4YFfmKAZ2tWD5WtcRxzkebFbrLyPPEikYAsZIz3:E9gSA64YW8K4MZQ00EOS4Lhq4YFfmKAN
MD5:	ECD1472F7619D89326F308DABA8CFFE3
SHA1:	AC4FE0B2501AF9FE2866F0D028C5FCD56768D431
SHA-256:	9A41DEA86E5298CAC5F601F58BA4100DF330B8C342064ADE82F75C517A3B0CA6
SHA-512:	497CDE74ED8A0F2C264895B27DBA345725EE35D886CF4530A2CFA62FD71A2B2D121A5E0A7900C890CE73EBE539B57B82E71FBD4C06DABCA68397B596770F9041
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64072
Entropy (8bit):	6.608282850162704
Encrypted:	false
SSDEEP:	1536:vO97noksNVY4yQM8s8KU9oTU9j6qImAdgM3XRPW+292RK/1BI3HkkKajOhEiknAz:297noksNVY4yQM8s8KU9oTU9j6qImAdU
MD5:	91D5B8C378ABD54B49E001DB04413E73
SHA1:	8DBFE4F8589F584D05330FACEA335955905E090C
SHA-256:	123C3AC7668699DAC8D68E84E31CAD657244E5CB25C698525D1CDD1173D4C0EF
SHA-512:	D0E689C099FF906EEB33B947E59C3753EFDDE762D3250F6A506C54179A2C11813ABCD7F99C7792E8072A6DE7DC6D31D27FA47A138AFCD827EC14A69FD405874C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................x.....@...@......@............... ..................................................HN........................................................................... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......H...............P ....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107080
Entropy (8bit):	6.637040413259322
Encrypted:	false
SSDEEP:	3072:rWD4eUp+HQpcNg0MFdH+F7fecbTUwevPGY:riPUuQpRdUNecbTUPn9
MD5:	A973A87E053354B8E5BCA3940970EDA2
SHA1:	74B0ECB1754C0590AC124DCC838A41FC55B34AB1
SHA-256:	DCC03DB3271E2BF54D44A790119799DF9E217B73DB84578B24B5EC9F082E4BB4
SHA-512:	8E256712E9D0FF1F328ED85BC7418238C5E65D11950411F437733FA9E6E554F079D25F06985BF7E443B2BC2E44B57C272327173566281CFE65CC7D8ACDB16640
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.[...[...[.......Y...R...P...[...w.......V.......K.......D.......Z......Z.......Z...Rich[...................PE..d...c%.`.........." .........^......`.....................................................`A.........................................A..4....I...............`..L....T..HN..........H,..T............................,..8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....P.......<..............@....pdata..L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\vcruntime140_1.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47712
Entropy (8bit):	6.743964781245747
Encrypted:	false
SSDEEP:	768:qdCm5nhUcxgHY/ntXBzxvbT71oel9zu/AmV9zi:qI1z4hx71d3zMAmnzi
MD5:	34798510935FF576CDD2516AFB3D5BF5
SHA1:	98E6CEFC2C6761D602742DC23C024977ED71280D
SHA-256:	AEAE775B321FDD5B2FDF88D4D21F8119C376D6909839671B35D8E03A04F6B609
SHA-512:	F18FB3A2E4A82DF6B025E037D4A730B6985C212936547E0BF19D7AD76D7AA49B06162A773EB99664BDAF1A37932AA2CD35DBBEF83A89BA4C80505E820C3AC13C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8@..9...8}..9...8.._8...8...8...8}..9...8}..9...8}..9...8}..9...8}.38...8}..9...8Rich...8........PE..d...g%.`.........." .....:...4......`A....................................................`A.........................................k......<l..x....................l..`N......<...(b..T............................b..8............P..X............................text...u9.......:.................. ..`.rdata..P!...P..."...>..............@..@.data... ............`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..<............j..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61536
Entropy (8bit):	6.622372328119638
Encrypted:	false
SSDEEP:	1536:TO9gwu6Q6WwlEaDcQwi2kBPcJ5kGvxF825mb6ZB+D31jnVJvWf6Qjlux6+nEikSQ:69gwu6Q6WwlEaDcQwi2kBPcJ5kGvxF8g
MD5:	906FB620C50C4C7EBFF5791603490271
SHA1:	37AE916A56C30D81B9617F8503EEED3992FBC05E
SHA-256:	2B58D9BE8E4F6C6F621AD28F590A708F5EA2C87B03C276AD6BFCEAFC3FD80135
SHA-512:	EE656EC98D1C3CC2B570D8A187B3DC24DB9202812F75372D2A23820870FAA625FCA945BD8D388FD3511744003B236AEC5DCD675945C4E59FD0D3BF51E345F60A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................6.....@...@......@............... ..................................................`N........................................................................... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......p...............P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58440
Entropy (8bit):	6.69454740850101
Encrypted:	false
SSDEEP:	1536:BO9WbWCHB/rkbEqBAVidKSlcZSI3+B0ncFytfjCqpXFBwW8jeFLd8EikKwsOnzex:M9WbWSB/rkbEqBAVidKSlcZSI3+B0nc5
MD5:	CE1AD81DEDBF6F14A73ACEE060E2A1B7
SHA1:	EB494BEB84E84FB1B2F9269623B00CF9D28FBD8A
SHA-256:	6412546AAA0E1C24A8381520DFC495C6F9D7789BB912F8EADD48CC7325035E20
SHA-512:	FDB847D2B021251CEBED07B437420CD94AAB1BD92B60C3873F33F1B68CD9B0D9A0287C34E23087074251629EA04B7B0F5FBB8AC3C530BD6621D2B601AB04375E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................a....@...@......@............... ..................................................HN........................................................................... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..9...................................................5..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58472
Entropy (8bit):	6.707560977053907
Encrypted:	false
SSDEEP:	1536:nO9WbWqDTFAyR6j4hxW50IEdIhR2Ji1paNSh0CvJaCuXaSQCHM7IXLDEiktwsOwV:O9WbWqDTFAyR6j4hxW50IEdIhR2Ji1p3
MD5:	1330C50B0A761AF68E519A0BACD736CC
SHA1:	7CC90128B38291F22A483A6F19299ADACFCD62A9
SHA-256:	C859C796261C20575473A3B7680B0464BEF20F8A0E3C3807F05D4A360A63167A
SHA-512:	BE5290A1384F90FCD564F94FEB2A614768806E224A2E71AC9ABE42289241485781922B406F8D484C0C485FF9778F5E6D43903DB73676C55DC33FD3D87F78C761
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................oD....@...@......@............... ..................................................hN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P ..\|...................................................x..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\AddinInstaller.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33864
Entropy (8bit):	6.6749170427672215
Encrypted:	false
SSDEEP:	768:bgYy+J05SY3wauWD5Epw9z9gElzEpw9zT:FMcYgauA5Ep4z9ZzEp4zT
MD5:	7F17A972A3F083FC309E93C9ADA8AA10
SHA1:	0072330558FB6E91FE6801DE71ACF06A716BBA5C
SHA-256:	98B6CD35884C8AE37F33196A132D0029100C0BA8AD2EE0C084A4870CFA832214
SHA-512:	D2B924E1BCD5EB260B17CB58E527E87D6FA9E772088F95DF6369599D7C4FFA3866F83D35F6AB333667C129FA8AE9CEE781A46FE8781B37906A60AFC301EC48CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....q..........." ..0..............L... ...`....... ...............................6....`..................................L..O....`...............6..HN...........K..8............................................ ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............4..............@..B.................L......H.......\)..."...........................................................0..y........(......(.....(......(....-..(....&.(....(....,C.(....s....o.... .. .j1+.(....r...p(......(....,..(.....(.....(......&.............ou........{...."..}........0..D........(.....s.....(.......r...p(....r?..p.(.......o.......,..o ......&..........'4..........@@.......0..^..........&...%..\.%../.}.....(!....(.....s"...%rC..p.o#...%rI..p.o#...}.....(.......s....}......&..*........E..Z.......0..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Assets\NewMeeting_Large_120.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	7.73830447681088
Encrypted:	false
SSDEEP:	24:+5DjKVMPFXHX5S4wKHWKWZGmy/xRftEircOiO8UN7O3:+5i8HplNRmKtFPPo
MD5:	E3B1BA3900BFFAE493B4463F9A6FBC48
SHA1:	0BDDCAB7F9537F01900CB7A7AB0FBB1042E460E7
SHA-256:	8FDE3D7378D0E9148068C3A9406D5BD754E93C9810FF5D2B8535FC2B65E0830E
SHA-512:	8CA0A6304BD871B1F2BECCF6AF9CBB2EC97D05B233B9388CFC760B262509B8BF6F9B50B837D21018FCA6E8627FA11AE67F6AF49440A837701B4C9AE920585246
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....sRGB.........IDATX..W[h.A..w.5..4.-..PA....(>@k.\|..._.OA.k1.X........-..a.(..?.)...........hv.w..fw.... .Xf.>..s...@......z...........;%I:.9V.....B.>.;.$.@d.C@.%...W4.K.......).#.....I..u.Fr........8.8....z...UQ......$Y..R.n..#....L.9{.&M.h.6...P"zUQ...a....:.D..Nr.[.u...L.>....K."..'..t/..Yz....--...M.]...e..0.l....!.r./)r.].t..U!.l&...;....i.,I.TD.H......).S...D..P...sV4!.......K.r.\|...... ....Q^.5P.VI...`'.........`...S.Z......?............`......9....g..[.i..Z.\:#.T......2t).b.........Y..<.T...u.`...... \..nL.f.....3A....'7..zDi-....r].k/Hfk....b:......@.k...,D.k...#.j..Z....@<...}2.a:$...Q.vL..u...o.Z..\|I.r?.o.;..".8..{~'.l..fG3...x...W...%V.....h...!.;...gA.$.?F.w..Y...1!..yu.].....fW..>..w..).55b....D7..}.?...._...=.....".+..N.\Z.mup..p..d\y...r+........:..G.Q.S....>..9..[.L.@\|.:..qMP8E.B......R7;....Pk..F.......s...N..F@.B.G...0...e.:....T....d_....i:.........5....].sa^.@!..#....'.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Assets\NewMeeting_Large_144.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1237
Entropy (8bit):	7.788008184019191
Encrypted:	false
SSDEEP:	24:GVwVpPtyAjoNiCkbbtwi0G1UA9WdK+oJgsQ6QVdAmwQATjZWwrpFbVD3r:E6FjowPv70tB/oJgl6Q8mXAT1XLr
MD5:	6974CFC337BF190D728C6824EF94AFB6
SHA1:	741DABA13F01C19518E2E1E72A93DF2C96227934
SHA-256:	115340C0940669C7A55670F03737492FB86D5E34E0390E5664EEA3F9B4147B0C
SHA-512:	679AFA5D417748680624314A6E5FF63CBF37D11BF5E95FD2D2114076F1DCD75196849EB39B1D456A8A5DB0019EF2C4C2FD61EA70651DAF158B87A69D8B017FAF
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........IDATh..YOlTE..f.n....Hl].' ..(.1.......$...&....4.&..=.@..A{C...`0.....$.@cz......m....7~....7......%....}...o...H.$.Ow..r..9'.CS...G.{.j...@F..3_.Bx\vc.`xx....g0..&'...m...\...(F...$/2...+.[..%y.(.A......sZ..Z...._.2..V......."[...SB.Y}....%eUV..@...V......G...8.Q....3..}...+.Rq...`]...\.U..yL.V.<.Z.{.1..5P/".&H...5.....D..x.:..m.b.....l..Gl..S.y....."...k.....cX{i.p..pFHtV.8..)....Y...,;U....O,XQ......,.Z.Eq.V7....B.0..b.......Bs.....Z.........}..wp....E......U.......F..........av.#.!.../.......b..rG....E...ZV..W..]w...\..~.q.f.#...K(.2..bU/.L/.b..7?.....6Cg.y.{.R.......9.O..n..H....tYb....ZR.<.t)-c..t..... ..x../....;..D..k..D.....`.J3.d...m..d.LYi&..@3.-l......z.pE.T..Z.u..R..."P.(T......7.%.... ...9.%.....O..p..5..bQ.F..o.u.o.2.B.....l/...1.8-..e....B......\|P.E....vZZ;.Pj...b)..z..r3..s~../B..k6}Z+.."V..[.......T.D.jAU.n1.%f3:.Y..s.{..*..`I.$.....w..T.H...?..:X..OQ...b.N...

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Assets\NewMeeting_Large_192.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	7.805621612269991
Encrypted:	false
SSDEEP:	24:xyPSt6BuLqrVii+xXSCLqmgDvjUEAkgoX1Amyz/zaY6pGtqPgmeAkG0ZZz:cPSt6G2iimqm+6kgDl/t6iEfGz
MD5:	177094A528723CEF49FA2FFDFAB57CF5
SHA1:	CBAE150EDCD83F2E9BB87A0BB86CF076EEBC41C2
SHA-256:	66CD5E3CFC69AF5087D33C570CFE424B50935B01C27E618CA11822AC7AE6D1E6
SHA-512:	AD9394116D2E132EB2BFF48F1AE4AB7AEC5B372FFD2B7B41E29CD8BF26C87725BB48D0C3AD85F7C3C94B4556872A06876D1E95F4AD8A0CF63DD949DBE350D8E8
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........IDATx..Z]L.U.>..,.. .[)6<..b41.`..4M.>h..........&.H.l.Y_L..6..&ZiS./.'1....X...F)....dw.z.....30..:7......9.g..@.........n_..V.........]...9F9.?..2C6...u.h.#.....?..19...U&....P.@_.R.#FY..&....P2~.....~..J..(../...I .y..Q.R3....Q.y....a...8)cwv^.-...?..6s....\|....'Z.e:.4_..w....).Uz./\..........pG......N<...1.;..X.XO...a.../.OS.._.).... ..e...dz........\././...u^..-Q.'..R..D.l...._1.5..G. ...t=,a..Bbz.+$J.BNB...V.&7.3....&,..Y..u..0w....}.......v?wv....TF-vN..&&f,..\.#5.....6=..p....y{3...m1....X.(.-VjqO..S..u.x...e..,......3p..."..`..@..0U.d.Le.,......\|.....A.d.f>.......m.....{..T L......kD>.....K.....4Qv....J=...o;[...4d. .....O.S_...I.y.....Q.\..><.....8......r.T.?3.eK.......b..~.@9.....ll......Pkyh...n,m..o.\..&.ai)YJ>E.......I......rWG.tu..ftl.^..R...O.Euu%.....&&K.......Hp.Lx.......K....cE.,a..`.1....i.h.5..!.......7......u.OP.n.[o.A...;.6....".&..o..v.4(34tj......U...C...u...S.N....H.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Assets\NewMeeting_Large_96.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.630755600269692
Encrypted:	false
SSDEEP:	24:L9IW0j2BjoUb25MCbt+OzOGKynRHS/0psG7:LaW0l2Ut+ONRy8+G7
MD5:	FAFBA571265B20E0EC4423FEAD972E1B
SHA1:	B686D74FF48E3B990F0E312BB0F3AF4E8F53069A
SHA-256:	1FB3B4832E92B1E2F998CD2FF4A872000822CBB897D869194195E5C4F8D43CD0
SHA-512:	D0523CCC27436A80C5A14094AD244349EFE68FB5A813F97539C3025FCC1F05D6CEC9B8FFD04883E35BCD787A36901246687162B4B86717E81E747B2CF035DD2D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB.........IDATX..VMh.A....i..$-j...C..M...`.T..A..,6.VYj.T..(....=.^...E.....b...4i$.I.....n....<5......y.fv....ZM.z7..Z..QB...t.V..cj"...gK...e........YI.>?$.V.^......ZF...av..cn....Vi.]P.(..).v..Y.P..s....D./n&YpJ..iG....8.Z:..._.......................~3.......Y\.T...H.J......n....c.p...x.n:....i>....i......i.GvLd....SRx5?.....3G...3...i....th.5...._..CGy.....R..q.I.>....\.e>x...#......v...L6OV....uR&.....o.#...y6...c...r,..#...B(..e:.K.6..:.r....+./....g..@..!....N.....=.H....#.....j.K..F.&6Zk..."......d....].Vl...IG.......:...]w$p.+...4.......k.j...$.ja}..x...(%.x.9\|..a.d._0sy..>oL.....%<.0.C.....;..(.!tpb"...N.R.Nj..?.."...RH.......8.Gb.P.i..y.L..OMv.Q.o;....[.sQ$A.8}3..cn.!wn.N}..m..#x.'......jV...T.G.?[..3.)......X........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Assets\NewMeeting_Small_120.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	574
Entropy (8bit):	7.347738166641519
Encrypted:	false
SSDEEP:	12:6v/7iHKcqzpeXnDvyEqCcmpZndaYcfyYCta8eq0NRFWBOfmcN274Gl2E7:6cqFeXDvyEqEpZdaYcStx0LFgOfzkUD+
MD5:	503E86E4628933D17B5B41B4918D6C9F
SHA1:	F884F45CF4EF5B435E554EA30F654F076E50BDF5
SHA-256:	1C80CC98643E1D060B9443C98E9AFE663125398F7BB99E5BAB2C0EB952C9C111
SHA-512:	22D115A09597F7A8CB0C5BCD0E0BBA55798D3A431B28EC27E9DDAA356BF0AF674BDB78E6D9A3911E2750354D42A8AD628EBD0A7716410360F6D1160258E12C98
Malicious:	false
Preview:	.PNG........IHDR.....................sRGB.........IDAT8.c`.....:.....o........'XX........K.&.2.....`>........}....Y ...Li...n.......K....103.1pq..u.].. ...g........`..C.^.......w...~20...k..4.....d>....0.Bv...~.....>P...A.dddx.. 6L-8R......lY.....>!{..k]8.._@.V.W..@1.&.2.f.L...S..f..L.`...'...Oa.@....f../#.....d........G...F!..c.U..-%..q!#.5d].V.G.2.........$....k....Y.....=V.8......8S....#J....e I.YOQ..)0.(.L`..`db.q............4\|.(.s.H...,....Y+a&..r...D:aecm...&..q....Q{..[#.+.a.a4..]b.B.`\|d.g...c..j-..L..@\|../@'...........".D36.@J.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Assets\NewMeeting_Small_144.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	627
Entropy (8bit):	7.55832772949955
Encrypted:	false
SSDEEP:	12:6v/76fR8ZKPil+HE3xZKPwUonTJibKpwwCzc8oRNn/Dna+z:7R/PUsE3xZ/zsbKpcI3Dna+z
MD5:	75713D844925AC3404D59C5D56DD996A
SHA1:	88F0F5B5450772A85FD61FB5FD54C3A6F7E48585
SHA-256:	D4746496079E9C334715958852FA8FB59E54DBDEAD19D83001FA15C1793D27B2
SHA-512:	B60E132BD5251084B2C7A22591D72DFDFEBB7A24987ADB8E78CA345694F6043C1F3C7A9205B6052CF3846FCF33179506BFF88C1D1BC8093A7563CF150EC5D30A
Malicious:	false
Preview:	.PNG........IHDR..............w=.....sRGB........-IDATH..TAKTQ.>.7.o&.Y.e...ZhJ..\..-.6AK.@...b.+.h+.. .].m.pg.m.. "....7.x...;...6E.....\|.\|........&.@..../.....A.[..}...p.Y..Y....j(i_c<)...X \.nq)......OO#.........I,......-.....].4..d.!.....,..Q...vu.-PP.........\|.Q^t..@.^..dQe....^/y..'....mA....o.h.....t...x.........A..?q...>....<..#g...S .\..kko.\....l.).L.L.7.l..!KwbP.?" ...?,.w.q-....y.".\|.O....Y.4..^J....sC..Z.;~..R....8)H..p.....L!.......[^k.+.u..w.4(.1.Z..q..G.AM..{.gj..L.b.\...\.m~..N.<.f..........Y...K0J..E..^.....D)?..c,.../].p2..1.2.D_u.s.x}...?TL.?~..;P..(.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Assets\NewMeeting_Small_192.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	875
Entropy (8bit):	7.664401472706693
Encrypted:	false
SSDEEP:	24:MnF5WncYHQTt0feBgmzpRjRqgnoEmDDxM4xr8LTdIDg5X:MFAncIQhee+mdlRlTmW9uDg5X
MD5:	F323D73771349B6374462B8A4B708D83
SHA1:	39F8860AEC7AC9FF8DF80C770A23F3AC8C3BE4A1
SHA-256:	EA0327CD2D987CF069747F70A317E552C0304170177101AA578F04D2EBE9FFB6
SHA-512:	5377FD3886FCDEF87B61F1CC825655E6B977E370563B2C2F7B3BB675B8ADCCE621A47F056945A9C0A41F9C10BF4DF6694167E62A310B146587F898D39E753EB2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB........%IDATX..VKh.A..I6O.H..$....../Q."....z...x. ..."X..`OR,.C..Y.h=."^....Q.U...ib.;..ufg..d7.P.......?.L...p....Lt...-.P/...^I..X4.X..........A./&..'%'.k.....,..\......l.j'Y1f...L.....~p.?n^..N+6xF..^}...3...`..(MN..Q.H.0^`XCG.^[z......X..0r..\E.n(..@..b..#....._....\..=.,...#.7.....t.x......I.$..-..W1F..o..Q....x...P)......S!......v...zd......+...#...O.....Q.........!..2...$....p.X....g.5....e.o"..V..yQ..I.a<9?..\|.t...Z..O..Bv............Z.........r...W#...-.`.(.0.Alkp...7a-..../....Mt`.g.......4.].5.z.X.Z...gz....R.S......-.1.w`a.......<........"..E.4\|.X..T...no.M0./..F..k.P.uW.].f$9.pY&......Un..N.3\|.......`.....2..e....C......r...g.Oj...t..`..s...PE.].v.,..S.J...P@u..q........[G..0..0...9..Z2].u...\|......Ru.......}...6...W&z.4.S..0\..K....n.@a.Z....(..9.........3._.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Assets\NewMeeting_Small_96.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	483
Entropy (8bit):	7.310129121242215
Encrypted:	false
SSDEEP:	12:6v/78zmIphkxF+oabzkBMDRbuyP+3uvNg9e8lJD+SF330YN:46m0hRl+3q+nD+SiK
MD5:	A2761DE768472D09D1E02C92EBD144B5
SHA1:	60BA18F0FF47B9E9C3E23B5AE9E95E3D319B5C5D
SHA-256:	AC7FE3232888BF96C520D586C723149CD3127E1CE7CC65BC35BA1984CC27BBCA
SHA-512:	F330DB55B79E561D2DAC1CD051421F91D6981A489A004EB0EAE3AE090B1386DDF46EFB675A9B6F75A0BB83F741B5DA12E4DFB872EE41782773BFAEC9014CA667
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........IDAT8.c`..0..?i.......e....?#.Nq>..<...Y..`.W...00.......?..........;.jX.=6,4....N.\|~....._...K1.....A...l....>.{..m....2........;?...<.......\a./.tA.H.?... .l..f.......s....p...V.KB.x.D.)2D.)....l.}........`.....u.!...7,7....H.O.^.B....?..`.D..2...C..e$..:...7...B.`d`..R..D`0?.....~G1.?....KFF...L.. I.(.+6..z...).....d......5.h..q.+.2..,( ,W%-c.....Y\R."........Y..... ...7.@..?..-....JkZj.w.....e.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Applications.Telemetry.Windows.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1626208
Entropy (8bit):	6.836593084030771
Encrypted:	false
SSDEEP:	49152:FiooDWLdfZohLu+Qzv53gyYq/t1CjQaLOGwkR2HwMuTwbXjBWQ1KLgKRw4jZh:Fioo+dfqL81//Ijt
MD5:	56782B45762DEE25B58E68D574A91468
SHA1:	B36B5BDF938132CDE279F555C3F0FFC58B17C540
SHA-256:	19071E7F9D27FE8E766456FA5224A12588DECDED12AE305A082A5BD48E3D1CB6
SHA-512:	1161162EF540F5D327367BCE65B39B1154916FF8D36464FF571F9D7D70F9572E48FDFC79B467917792629AE0B4F5B787798858B09370D36BB837D9A1D5D4B9C3
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......&..?b..lb..lb..l\|.Xl`..l0..mi..l0..ml..l0..mf..l0..mE..lk.Hla..lk.XlG..lb..l...l...m ..l...mh..l...ml..l...mc..l..4lc..lb.\lc..l...mc..lRichb..l................PE..L...76=\...........!.....l...........n...............................................T....@..............................O..@...........................`N..........@...8...................`:.......P..@...................T...`...tR..H............text....k.......l.................. ..`.rdata..Z............p..............@..@.data....t...P...Z...:..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.JsonWebTokens.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78408
Entropy (8bit):	6.129481246167649
Encrypted:	false
SSDEEP:	1536:nm6516C0z6v8JyJNPk2DuttJ6gDEkeLGzewZGLzw00f:nmqEC0zhyJNPktDXiGyRv0f
MD5:	EEA13258A8B7DE541A74D2912769F2A7
SHA1:	542082376A88F30ACAE47D71737A043A05334B1A
SHA-256:	E4FA6AC046B919137158954B182A647129990B70399C9894CE6918F0FA893262
SHA-512:	A8E7A6F7476867199D2E499ED09F11742593B398FAC4B4F3CA9C2D3496AB2A1B80A5E439F4444342D0A30BB3C74FB1A616E508DD05BBAAF6E54681F5F56BF8A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{............" ..0.................. ........... .......................@......D.....`.................................Q...O.......................HN... ......T...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........[...............................................................0..v........s....}.....s....}.....(.....(....,.r...ps....z...@...%.....o.......i.....i.3....(,...r#..p......%...(....s....(....z...0...........s....}.....s....}.....(.....(....,.rd..p(....z.(....,.rr..p(....z...(....(.....!.r...p......%...(.....s....(....z...(....(.....!.r...p......%...(.....s....(....z.......C..Q.!......s....!....j.(....r...po...+%-.&~....j.(....r...po...+%-.&~.......0..F........(..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.Logging.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41032
Entropy (8bit):	6.710594759580758
Encrypted:	false
SSDEEP:	768:vS0Nb06pBrs9OoJu8Gw1OQaXV9zPgEllVXC4dC9zVj6N:vnb0NO217GnzPZ/C4dezF6N
MD5:	E6F3F341BAEB31F4196C3085FB34F767
SHA1:	D78EBC71D36B06E0DA7FA41E6D7888FCC71042B6
SHA-256:	4BE875B73CD50A95A1480FD3330222C278903DCFA9EE73263198D860827EA9AF
SHA-512:	A38A81B096D215E04947BDD2E7D1532E676C8E84DD9CD598D98EE5EBF5C1197CF1AC690F28DA0EAB3DC1CA42CE0CD9F1EAA0901E7CD55C1ECA927D86E880C365
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[c............" ..0..H...........g... ........... ....................................`..................................g..O....... ............R..HN...........f..T............................................ ............... ..H............text....G... ...H.................. ..`.rsrc... ............J..............@..@.reloc...............P..............@..B.................g......H........,..x9...................f.......................................0..I.............r...p...........r...p.....r...p.....r...p.....r7..p.....s.........:.(......(.....~.....~............~.....~...........~.(....,...(...+(.........(......(....,..,....(8...(......(......(....,..(.....2...(...+(.........(......(....,!.(.....2..,....(8...(......(......(....,..(.....2...(...+(.........(......(....,!.(.....2..,....(8...(......(....*..(....,..(.....2...(...+(....

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.IdentityModel.Tokens.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	937544
Entropy (8bit):	5.838809981110096
Encrypted:	false
SSDEEP:	12288:uMt+vIZDreuKQvgXyexT4Yn2sxGwmBgjoIb:jVbgXyeV46xGjBgj1
MD5:	528D783F83C540EFC5F138D21E8C1696
SHA1:	64F87F45719CA06143AA6328A52E6A96285DA63A
SHA-256:	CE06CDE2B771E6E215CA9A10F8739A23AB2990A53C32301E42838D40E8E355F3
SHA-512:	ED2562BE767103C2FD7179B0F632A2250F8EF97950341C6D0FE6AC8BA347499682CF7201289169855F313D47833F863FCC110B54864A8BBABF046FFD8B5902CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........." ..0.................. ... ....... .......................`............`.....................................O.... ..................HN...@..........T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........0..X...................T........................................(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{.....3...{.......(....,...{......{........-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..o....aX...X...o....2.....cY.....cY....cY..{......{...._..+%.{.....3..{.....o....,..{.....{......-....(.....0..H.........{...._....{......s

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	252512
Entropy (8bit):	6.362389658905794
Encrypted:	false
SSDEEP:	3072:yDooTOC7Qc83rAUPtqy/KOak1VLsJYI52ZTG1h7iriwV3nm:yDoor5+lqyCa5sJ/7imAW
MD5:	7FEB8740803639B2D4F945032AD5AB35
SHA1:	1A96043B957A544D2A683A9F34273B3D4D410176
SHA-256:	7AF7AB8BAE45CC39108640B02BF864A0923EA9249C11D11DFDB375ACCE6A5787
SHA-512:	0469C31C0BD093C46FE6268B1EB6FFE512F198C1EAD0B4D463072F2C0F5AFE7A09A4C80F8FBA89714B2B54DB3C111AEF066FBE0D862EF2C2EAA86E8D4E5DFDA2
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........iL..."..."..."..p....".}&...".}!...".}#...".}'...".p&...".p#..."..Z...."...#.w."..}&..."..}'..."..}"..."..}...."......."..} ...".Rich..".........................PE..L.....Xf...........!.........r...............0......................................;.....@A........................@.......0...,.......pj..............`N......P(......T...............................@............0...............................text...:........................... ..`.rdata.......0......................@..@.data...............................@....rsrc...pj.......l..................@..@.reloc..P(.......*...b..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AuthLib.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40520
Entropy (8bit):	6.639030202064737
Encrypted:	false
SSDEEP:	768:oom7dmnAf1mkMF51ap+v/7pKK4gKK9zNEgElAVXC4dC9zVj6YM:aR+aps7pfNfzWZ8C4dezF6YM
MD5:	B05D496887FE2A9E6EB1B054D7C67FD0
SHA1:	D67E9867684EB6ADC456A8A12DA59A043ADD9F63
SHA-256:	B66E0755E36F168AF5AB5EBF6FC493FFC6ACF322DF0446DBF03D9531F1ADFE81
SHA-512:	2C5BD0172B2D9B7CD629B22B25E7C7A1FF19BFC7A831F622E7A388AA4D9F2FE3F2A6D2A48F5BFB81B727BEAD80B07A07F5C9EA1777747EBBC46E806398223D2F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..0..H...........f... ........... ............................../d....`.................................Df..O....................P..HN...........e............................................... ............... ..H............text....F... ...H.................. ..`.rsrc................J..............@..@.reloc...............N..............@..B................xf......H........-..t7............................................................{...."..}......{...."..}....V.(......(......(....~.(.....s....}.....~......}.....0..+..........{....~....(....,....{....(.......(..............##.......~......0..........~.....r...po....~......!...%.r...p.%...%.r-..p.%...%.rE..p.%...(....r...po.......{....~....(....9.....{..........(.......{....~....(....,r(....o....(....rc..p(....(....&.....(......~....(....,+....}.......(....&..@.(....&. .....

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.Diagnostics.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33384
Entropy (8bit):	6.800503141051873
Encrypted:	false
SSDEEP:	384:Vd5BNiiCEvdA5LfyacHbZTmwBWYsQWRCs1MR9zlN5W2pM/NEHRN7b2IR9zgRqt1O:VdrF05xwn0U9zl+2pIAKU9z/0
MD5:	32743467628DB11AC5AC9C7BECF72430
SHA1:	26FF39C01012934345C3FD4B156CEC0BD240941D
SHA-256:	79906800C06A9B80BB204233EBB7EF05168218C687B47E7AC1DACE115A028CF1
SHA-512:	09455FAEAF0E21D1E6C2A5413C259AF8AD44E674B9EAA766DB9CB4C71A659B3E77177C52292B67983900AABFCF8B5A31FBADD4FB711A72D8DFE5A1EDF24B5C2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..0.............I... ...`....... ....................................`.................................PI..O....`...............4..hN...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................I......H........(..P..............................................................-.~........-.~.........0...........-.r...ps....zr...p......%..o0......r=..p(.....%..o1....$....%..o..........%..o2....%..o4....%..o6....(......o8...,..(.....o8...o....(........(......(....../.rs..ps....z.(....,.ry..ps....z..}......}........0..Y........{....-7.{.....r...p.{.....$...(....s.......%.o......s ...}.......{....o!.....,..s......F.{....%-.&("...r.(.....-.r...ps....z..}.....0..0.......

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.MeetingAddin.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1097800
Entropy (8bit):	5.792143415990996
Encrypted:	false
SSDEEP:	24576:AH7EkgPiZ5Bsu0G179oVVmfLEq2awGQUZ:a7EbXs79oVVmfLEqNwG1Z
MD5:	257D3AD395C9CF96B0B06DE7AF86959B
SHA1:	B6C9A1E7EB119C7A8FF4FA0F9D3FB96DAA7E25FB
SHA-256:	D6E3E4C181A50F751BF0ABB51E9F678B8A670144C7ADE4DB99103A2AFE9FFFE8
SHA-512:	061473D98CF2397607CB83EB59F49F028D2441B1F18E11B64F096E3FD2FE85D8A400FCC9CF60CA7C596218BED46CEC417ABC16ADBAFC899DC678977AE58D5A4F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..0..h..........F.... ........... ..............................w.....`....................................O....................r..HN........................................................... ............... ..H............text...Lf... ...h.................. ..`.rsrc................j..............@..@.reloc...............p..............@..B................(.......H...........H............................................................0..%.......~.....r...po2...~3....~3....~3.....sM...}.....{....9.....{....oZ...,.~....r3..pr...po4.....}....+h..{....sd...}....~....r...pr...po4....(5......{....(...+...{....(...+.~....r...pr...po4.....o......o.....X.~......r...po7....D.~3...(8...,..(9...&.~3...(8...,..(9...&.~3...(8...,..(9...&.(:...&.........."..........."....D......(;....(...+.....*.0..C........o......o......,..oa...(=...,....o....+.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.MeetingAddin.dll.config

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	5.076136391837345
Encrypted:	false
SSDEEP:	12:TMHdGzNFF7ap+5v5OXrL/2/tFicYoKV7VirkTyxm:2duPF7NhOXrT2/H9kirkV
MD5:	ED080ED5825CF4893CA4F7D1395B9957
SHA1:	3905E190109E5DF90676F4716A69C815A6E52B44
SHA-256:	29F368DEF465F1AE30DF31EBCA4A976F180DBCF3718605B4ACB0D6DA95A30855
SHA-512:	73041863B7916B21A56D5C61933D9922D24B15548D7356DFEE42C3AB617F72A04AA8080F3C5EB3F21D968FFB38C7244D4484E78540BF6BB8FC93600A017E43D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/>.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0"/>.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8"/></startup></configuration>..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	295008
Entropy (8bit):	5.771512173166689
Encrypted:	false
SSDEEP:	6144:6ylhq4ugopeh5eBeGNx8cNe+zcee9eoedTeeIzeqRK0e6eR9pRFIEIEEICepM1Sj:2P4eR9pRFIEIEEICepM1S2LQQs1hP19x
MD5:	D3A3E82247F81342E217C92B9C89BC86
SHA1:	CBD914785348331AE68528ED71E317ECADDC10DE
SHA-256:	B39CA19017B8B99385A588433B4AA1CC87DDE272DA14771A9750F00605D31091
SHA-512:	EE5968A216BD402632A0CA1073B8C4CA5303CF28F30002AAAF2E7590B565FA3BF951E7B62320E4E3592DE50B9F56F08ECADCF67B50659DF056BB5812388A962D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....].a.........." ..0.............H... ...`....... ...............................b....@..................................G..O....`...............2..`N...........F............................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................G......H.......L9.......................F.......................................0..G.........((...}.......}.......}.......}.......}......\|......(...+..\|....(.....0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......rZ..p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....*.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45152
Entropy (8bit):	6.663371468091526
Encrypted:	false
SSDEEP:	768:iTFfTl1XWYTACPHZDgcE05P4Jjrnh2jwSosuTv1JKa5/Zi/6LsubsOzMnXbD9zMz:iTFbHXLPHZDgcE05P4JjrnawSosu71Jh
MD5:	F86AFF1B72BF70884B4BE0CA38919369
SHA1:	8D3DDF77DE94F5EAE244AD09F9D2ADDCC2DEF709
SHA-256:	69B2BBF16659F98D589942A1A3F344550DD1E03446DF4F81DC4668F1D51CFEC0
SHA-512:	718F629F907EDFADFFCBCA135DB6153B2BE001E450940722B43C16279CF9ED0A6384D1205D3287F397B2E8FCD9A5615BB2497E8717B6CF6391EFADF1BB122480
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...03............" ..0..X...........v... ........... ...............................B....`..................................u..O....................b..`N...........t..8............................................ ............... ..H............text...$V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............`..............@..B.................v......H........3..T=..........(q..@...ht........................................(......{....>..}......}......{....>..}......}......{....>..}......}......{....-%..(.....(......(......s....(....}.....{......#.......?}.....(....}.....(.....(S......(..... . ...(......,..(....,..(....,...(.....{....,..{....o......( ...*.0..>.........( .....}............s!...("...........s!...(#....{....,..{...........s!...o$....{....:.....(#......H...s%...o&....(#......G...s'...o(....(#......J

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50760
Entropy (8bit):	6.631383698123452
Encrypted:	false
SSDEEP:	1536:0X0t7C3ZK8wDP/ryEH0mBO4JjrDXaUfUPLkIFKKa5/Bi/hGvoAwWKSVdxxzXZVP/:0X0t23ZK8wDP/b0mBO4JjrDXaUfUPLkR
MD5:	04B900A20C71F7A23BEBA77F88B86308
SHA1:	C5BCD7AE974EBF89F6D12F26DBAA9B4FD4CF2A53
SHA-256:	BBA041B5BE0946EAEDE57AE31361844CA781C9FAE80607980465C7F2422F83BD
SHA-512:	F40B2ABAD653F4433D8B7C665D37000780D7A1289F4B187F8B51CA7C8D577C7D7449A5E12C0DCB1FBBFC45403437D6F9F4AD09CA326239C4D1823908063CE19F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............" ..0..p............... ........... ..............................8.....`.................................9...O....................x..HN..........d...8............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............v..............@..B................m.......H........;...M..............@............................................(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....6.t.....}......{....-%..(.....(......(......s....(....}.....{......0..........r...p.P...(.........(............s....s....(.........r1..p.P...(.........(............s....s....(.........rO..p.P...(.........(............s....s....(..........(.........{...."..}....&(.........{...."..}....*..0......

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	714312
Entropy (8bit):	5.981067761075983
Encrypted:	false
SSDEEP:	12288:H9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc30:H8m657w6ZBLmkitKqBCjC0PDgM5
MD5:	D473F50D1D29B975DA5B6EE0BE8DAA16
SHA1:	AAFC94D3C26041CCA3737FDF6240290DBAC1388C
SHA-256:	E57E1BD98CF3EB35B61BC5603DA893DD8018BE8CD6CC582D263CD964CE1E47DD
SHA-512:	1BB89EBE3EE9D61ECD194ED008C25733C5888FDBDE41A3D248161EE4A708526489A2F79D23EEE97CCAB0D58622ADDE158E07225B8A64AD1F6593CF848206FACC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ...............................Q....`.....................................O.......................HN.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{].....{_.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\OneAuth.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3764832
Entropy (8bit):	6.859369138253314
Encrypted:	false
SSDEEP:	49152:HEERDAD3OE+TYoUjYnjglMZqCo8q4T3Ka/Z+fsh0EGR+hmahbt3pHGiOTYHf8P8c:HEERDAD3OFYoU8jgGq1V4TaHviOTY8
MD5:	C0A14FE8511CF67D40BBC606EFF12A5E
SHA1:	9E1A3183E9FDAE57B59C8A5B7A8D86360B175B42
SHA-256:	E1B7188C8F3713C188C4B9F3318EB72614C498493342B169234FBDE7FD2DC0D9
SHA-512:	4AC4BCF33E039F2404E088FE7E55634F032109EBF53A5EC851525DE75B4116D29CD75D29B186212DF305F6467A47F18D6C6190632FFC0D736C4FD7BA112F43D7
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......$...`..`..`..2...d..Q.G.b..2...k..2...m..i.).n..2...M......<..t...i..t...a..t...s..`..Q......d......a....E.a..`.-.a......a..Rich`..................PE..L.....Xf...........!......&...........#.......&...............................9.......:...@A.........................05.$...$15.\|.....7..............$9.`N... 7.4R....1.p...................@.1..... .1.@.............&.T....#5......................text.....&.......&................. ..`.rdata..$.....&.......&.............@..@.data....H...p5..2...V5.............@....didat........6.......6.............@....msvcjmcm>....6..@....6.............@....rsrc.........7.......6.............@..@.reloc..4R... 7..T....6.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\System.IdentityModel.Tokens.Jwt.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	94312
Entropy (8bit):	5.905204811037498
Encrypted:	false
SSDEEP:	1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gj:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0s
MD5:	A70D021C422B844D5B3708A619466057
SHA1:	5F63C78F20FA7E7ACA36C91F209D4215C854C90A
SHA-256:	5692B8A4E74EC8484A87D68379FC69FC119E980F79D2765F7FCA5BF5FA302024
SHA-512:	A8CDCC3043376A1D25B318739DB7545CCB0ED77C1E134CC03B5A009A655EA6861EE3E7246EBDFFA6D53B6BE31EBFFF93B34322488C1067712F0A280ED2B8ECB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............" ..0.............*7... ...@....... ...............................-....`..................................6..O....@..............."..hN...`.......5..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......4_..0...................d5.......................................0..........s....%r...pr...po....%r...pr...po....%r ..pr,..po....%r...pr...po....%rG..prU..po....%r...pr...po....%re..prs..po....%r...prs..po....%r...pr...po....%r...pr...po....%r ..pr(..po....%r...pr...po....%r...pr...po....%r...pr...po....%r...pr...po....%rr..pr...po....%r...pr...po....%rN..prd..po....%r...pr...po....%r...pr...po....%r...pr...po....%r~..pr...po....%r...pr1..po....%r...pr...po....%rm..pr

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\System.Net.Http.Formatting.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189544
Entropy (8bit):	6.2575053993527705
Encrypted:	false
SSDEEP:	3072:MXWun8Jw8fCk/Dvf5eso7DpGbG8pwp2xuRLYs8jn4xo:MXWu8Jw4L/D3UVVGbGbd2
MD5:	8FBA542C86765B116FD3B6A397196984
SHA1:	47D65C9D0C0D07C4E76F3516C90E7FD1CEAC1B0B
SHA-256:	7E0C5104F49C2B79E0261BAB191CF7ED25BBE9C01BCB7DCEDAE5C6AA1F8BA94B
SHA-512:	89C05EFE882C226EB55A0D234BE49E2D4D639DB08FB0BF85129E672CE3773EFFA82E7F95EDB1F7DE1F3B8B57B38203AA69E8B84CB51885A9CE9918332DC06D22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..[.........." ..0.................. ........... ...............................L....`.................................D...O.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................x.......H.......D...@............v...3..........................................R....s... ....(....F....s.....(....>.... ....(....*..0..d........(+....-.r...p(c...z.o,...-(r...p(...... ...%......(-...o.....(^...z.-.r...p(c...z.-.r...p(c...z.../.r1..p.............(g...z.o/...rG..p.o0...-'r...p(...... ...%..o/....%.rG..p.(^...z..o1...o2....>....rS..ps3......}.....o1...o4....+E.o5......s........s6.......o7....o8.....o7....o....o9......o:.....&...o$...-....,..o#.....(...+:.....o<...s

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\adal2-meetingaddin.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443936
Entropy (8bit):	6.527875057204511
Encrypted:	false
SSDEEP:	24576:lTLWvdxPRBVcPrV/guppMXb1xaKbtQnVfAEwCnCnT+XgFz4a0of+IJR2:RWvdxPRex/hpskKenVfA8nOT+wFzL0oo
MD5:	7B6F85665FC19F835F60DCFD446EEC8A
SHA1:	14FF072047A82CD3259D5895F9EEEFBD7F243F35
SHA-256:	A7BDE8B9A4073473A28DB5ABE3C12ADDEC08CCDA516F2DC79A79F3BFFFEC5208
SHA-512:	2BBD7FE67DD132C8029504F0BC5E50396A0BC26BEB3D705E11F04A12FC13334485345170B72567C9A865227B55E53FD21712CB34231C6A72ED5A96D992017A44
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......K.t&...u...u...u`..t...u`..t...u]..t...u]..t...u]..t...u`..t...u`..t...u`..t...u...uj..uf..t...uf..t...uf..t...uf..u...u...u...uf..t...uRich...u........................PE..L....p.[...........!.................X....... ............................................@A........................Pb..T....k..,....0..8...............`N..............T...........................0G..@............ .. ...Ha..`....................text............................... ..`.rdata...h... ...j..................@..@.data............n...r..............@....didat....... ......................@....rsrc...8....0......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	63048
Entropy (8bit):	6.588536490520649
Encrypted:	false
SSDEEP:	1536:0O9gSK8rih93rkkMy6HMyFPcIk9WvLdQWuB5X2PHJMK1SNahIg8DTuf3TV1EikMb:h9gSK8rih93rkkMy6HMyFPcIk9WvLdQw
MD5:	CD9C599823A276D142D9ACB18A8B801B
SHA1:	40B12D68A23FF1F31806D56D8A75E3C55A898C59
SHA-256:	6412C7FCB2836C0E059FFBA36FDF50882B61A5EC9FF23F780019A52E5C05779E
SHA-512:	10CDA635B5F975FACDA13D4480988A465775E6CE00DF0E4D34494D6943347A711B8922AFFD7D96F344A8CBB6FB3EA3A9B4E9E88F83F22C08C42008EB52DA4E5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ...............................b....@.....................................S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......................P ..o...........................................k..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66120
Entropy (8bit):	6.543326876591306
Encrypted:	false
SSDEEP:	1536:bO9nxMvE5lU94Zs+uNQGChcfaEt5tHBB8spapY1KCcLJIaSgN8AzlyGEikgUWsQ+:i9nxMs5lU94Zs+uNQGChcfaEt5tHBB8y
MD5:	D47B102DB26B2C40ADA0B88864D4BF16
SHA1:	5962E4ED89789D36A22130F10F5836EF9FD24358
SHA-256:	F0015E72C92B5B83FD23A62F8B0ADF25C53DA2005EB90BDD6ABE83BE4D91158B
SHA-512:	72E2F68460CF16EE211A81F50E63A12A61C5838D33D84D5A00C2F9DC44E6AD645A0DB01C22BC739436DD721A5BFE70D2B4E3227517CBFBB04B0C18E6669F444F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................... ............@.....................................O.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..............................................}..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.459202313419593
Encrypted:	false
SSDEEP:	1536:6O9PKsQZAjb+f5g3GTGw9dLFqH78Iu3vwUT/aDXeX3iqeVQkiO7imJOEikSwsyCT:D9PKsQZAjb+f5g3GTGw9dLFqH78Iu3v7
MD5:	158930A69BD74A6476AA3817D1C2BEB1
SHA1:	2B9F0777B03832E92C50FCC58BD793C43CE60865
SHA-256:	E540D3BBDDAF741A9DDC6F0AB16E4C77115CE1F4B2D4C2037A00285012E0C003
SHA-512:	9ED62D6B361248E4AEE394F57488685F4E027D17F91F22C903668E713632CAB33A960B5B4E2F9717194ED1DF7B08816A662E344E04B12B6C81A1C44F61E776D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................v....@.................................`...K.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..6...........................................2..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60784
Entropy (8bit):	6.521074063197344
Encrypted:	false
SSDEEP:	1536:qO9CKHHlgdQ4L2QSW6YEcNHuSlMGtrVSL4rOeqDuseAT8HNQ30pEikrKsBCz9Z4q:z9CKHHlgdQ4L2QSW6YEcNHuSlMGtrVSs
MD5:	6169CF3B98276F3CF9974DC2D1CED2D0
SHA1:	2D9DCA45E40BF720D1ADB1D2A9F7F20E4F2EA931
SHA-256:	45287112403521B91DE985160177515004F2618D0DDD1EA0B3B9EBBC10BA5D62
SHA-512:	3CADAA8A166FF5527B8266BC88956319A88230C02E1F279A0805CD3EE39B0542C262EAF7E558AEB6750AF291AD4E3A4264D7F70B6AB4ED60E4D30EF4D739099A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ...................................@.....................................W.......................pM........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......................P ..k...........................................g..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.486964327280261
Encrypted:	false
SSDEEP:	1536:ZO9ADi+BGe+Yj+fEligSKm9qI32i3loAECsedjllekCRf4FwpL6pTgscpEik1HsF:k9ADi+BGe+Yj+fEligSKm9qI32i3loAI
MD5:	085E2A3801FD052FA78EB35784861A67
SHA1:	A08D98B2B03AD9EFC473CF9ED529039983D93D9A
SHA-256:	77D095EC973D379CB55A8B88EB3DB34F5FC02BBABE36DA6A25EBA3F2C382EF51
SHA-512:	E2AF53D5A6C61C52C0981C83BCCDA87939D64DECE4BF0D48CC1573C4E2D4D3773CA49A3174381BE1AA50D22CA4258229DD0C18C556519AD4A9A6FE457A2D0DD5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................zR....@....................................O.......................HN........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\da-DK\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59976
Entropy (8bit):	6.487146751316606
Encrypted:	false
SSDEEP:	1536:NO9Nhjxn9FWv4GByP5KpHSnLbM9B5vBmGOv0/kOeR/1OgBly2bCR4EikxRsxEp4i:Y9NhjV9FWv4GByP5KpHSnLbM9B5vBmGL
MD5:	97D41B502E4BEAE98B24AA3A4CAE529A
SHA1:	0926DBF0CEB2A3ADE1085FA4557038F574390C5E
SHA-256:	E33BE073C742689A49FD50F7AF08D1F013DD79C6AD918CE976447BAF84B7AF67
SHA-512:	C0A98F9472FA74E6FBBB5AC731F0D1F817B8B272B8E486F67FA23CABD7643D1C72B4901452FE257A7D9D6EDB2F3EB6A91D3AE2050B2CBF9B56FFCDEE0B92A1DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................>.... ........... ..............................:.....@....................................K.......................HN........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......................P ...........................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\de-DE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62056
Entropy (8bit):	6.434087583320252
Encrypted:	false
SSDEEP:	1536:wO9P3k0b/0/IDJaXmsl/+ToOLWiXp3n4bydq5inL+yPocyx+q92nYHYHzB2iHG3e:d9P3k0b/0/IDJaXmsl/+ToOLWiXp3n4k
MD5:	F990C8CCBBA3F311BCB66CC36BD28090
SHA1:	D7EFAF9B2022B7EE0C794CB24AD2A8208C570630
SHA-256:	305A7A96FCE15405505331D6EF78DB5F88C4FBC32D5E9FE89EEB235DCA3335D9
SHA-512:	EE222DCB4DDFB650F18A3A7283AE8DE59FDC3A1E1A4DD58D80EC05C9934AEBD8DC9BAF9C1E77E3B1B5D66334CC7D823B6FBEBA57C6E17447AF8852DF454DC84F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................................@.....................................K.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\el-GR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67168
Entropy (8bit):	6.566460710824405
Encrypted:	false
SSDEEP:	1536:ZO9OCfiY82Whhf/Oaxtz9dgqn1LsIOYCZx/QxJHDv+sBkzKJMPYBj8UHN7oEikcL:k9OCff82Whhf/Oaxtz9dgqn1LsIOYCZZ
MD5:	C38DB5F652DE91B18DCCBDFFDCCEC503
SHA1:	75BD4F252284E87BD4613913FC9B2D408AF355AC
SHA-256:	587A707E0596DD62135410B2922DF2BF4E28A44793366ECB9F80579C8761DBE3
SHA-512:	9C7D6775838672A45E98AC7C21679E3607EFEDD7EFB8673965279067AFBB65E88D39961D1309FD586B151049AB2C262361A3DD7E02FA45C7D73B5AE0207A11DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................... ............@.....................................O.......................`N........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\en-GB\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.444190816855698
Encrypted:	false
SSDEEP:	1536:sO9jlXq39V7UTJazmvWyBmehkkSgwgt7pK1Iq6lDRyFxutpLdcIkey5JvEikr+si:Z9jlXq39V7UTJazmvWyBmehkkSgwgt7q
MD5:	0826E8C277C0DFE42735A448DB7940C7
SHA1:	8A7E1320F58A86745175B1D0301E822BFA04FB20
SHA-256:	1AA40D2BBA8F882BC44DF66B9BEA547A61012449DBFA404F3D32762BD728C865
SHA-512:	00728861F65405438F7C823A6CCBCA5B841D53F499B9B0B0856A9923B102E9EF36BBE1035AED809EDE3F2A40764F39811259C52A5A0287B9896C303F7805A11E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................>.... ........... ....................................@....................................O.......................`N........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......................P ............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\es-ES\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.471588224248052
Encrypted:	false
SSDEEP:	1536:vO9PcsKNcG6/SfNsIpERGRBPvJV50ATCaHC1B4/QYfsueQ5amCVBjEikgBs6d3zs:29PcsKNn6/SfNsIpERGRBPvJV50ATCa7
MD5:	601CA689F9075A86860FE17F6663A3E8
SHA1:	6DF7EE000E7CC0B7E81EAD584BF60F34783B7D50
SHA-256:	2D397D019C11FECE226947B075873BB1980FBC456BBFF743D92ABD9CD13AAC2D
SHA-512:	8231DC4D221D57A77159206D98AC874F920DB684862F22D43BE1DA0153B8CAF75B89C28BDA423FE9D1C3DF37EDA662426846963FBC7420D1AAAD162D59036ED9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ...............................v....@.................................\|...O.......................`N........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..S...........................................O..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\es-MX\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.46459183752468
Encrypted:	false
SSDEEP:	1536:SO9PcsAbAUxcRLSpEebIfb5lG2vuq9o7UtIbQrZuGl2v/+/UAsOkjEikRVsgz4Zj:79PcsAbAUxcRLSpEebIfb5lG2vuq9sUE
MD5:	E74A7CD5447B6A0E49D077774C98E529
SHA1:	9A57894B831E59EC3BAE33673D3D384C6CEF2191
SHA-256:	E60CB451F0EEA3519C88D69EE4D4214FFBAFA07C6CE75DA722FCEB5090D3FD44
SHA-512:	131CB8A58C7B0C814A7AA1472E3CDBD3199BC5B6AABE5FD39AD8D78E00B395D9681089753F89E3194D709F55EE8FB6D13C9EFC3AC246A1CD1F7C8205D189989A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................3.....@.................................8...S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H.......`...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\et-EE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59976
Entropy (8bit):	6.484108194961219
Encrypted:	false
SSDEEP:	1536:oO9pDyWBFils6mKaFq1ZU7iPZn3VfrsYaInkpxOM8zrBwl0xvWbiLvkLEikkls02:19pDyWBFils6mKaFq1ZU7iPZn3VfrsYL
MD5:	D111BF070B29A4DB93EDBAB50B0A750A
SHA1:	94B22AF2C90254600869ACEBEF6BBC6172598834
SHA-256:	21E5E83D0ED84060CE883E628FF61E05B141179CF861B9CBE83C222816AAB6CE
SHA-512:	6319377FF841D97379FBA879B3F274A0270C010EE0A70CC624A9862D7F1B46E08ADD69A7DB00B6B62AE7FE670B459F5E956D67C33B67737937088F42F81AFE59
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................*.....@.....................................W.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..Z...........................................V..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60512
Entropy (8bit):	6.482124743495525
Encrypted:	false
SSDEEP:	1536:mO9WHroG73/MBcBgbQtAIceIZJA4qErCGAqNDEvu/XcgKErjRfxLzqkPzEikp0sH:/9WHroG73/MBcBgbQtAIceIZJA4qErC5
MD5:	4191204671CF8F3D51B7C97034F7E8E1
SHA1:	B2CCD154E9679C5EDE4B61784F711F29E255DE65
SHA-256:	DE145030538AA124503DFAE7BAD0717A4515EA89E3E6F0F6BAECA72ABDCFA3EB
SHA-512:	046F578B6E95C8B5BD38D4D426E65AABDA7412011ED667E18E5B5EDC54BB1355CA5673600800F288C56216B54FD01865D1DC6CF64FF75FCFA4FE05882069BC93
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................h.....@.....................................K.......................`N........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..V...........................................R..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.470070999956776
Encrypted:	false
SSDEEP:	1536:NO9ADK9GGZoFZbcS0PFl8SJiJS4+X2uMd0dSBb/yNvd1SiUU/GpgYCv1Ny7qwEik:Y9ADK9GGZoFZbcS0PFl8SJiJS4+X2uM2
MD5:	604F05D82D7A9DEBE56EEC6330A8D56B
SHA1:	F606FD15D1BFE811996DE48C2B3CBB8C8819F58D
SHA-256:	5FB9012845120321AF415301EE387961F75C70BA87BC779725B7A66551219853
SHA-512:	3568A1982E827E507615863962D795AAD55CC049A1E98EC9734314B26E43F1BC82C2C8CB6D54BECE4D54427EB9D664881093D095359333C8B91AF6E37577194B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...................................@.....................................S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.474432837189674
Encrypted:	false
SSDEEP:	1536:WO9ADl++Qh8hF3dLNbJZIeiVFbdQ9cBxIjfwjRGaDZng/7HXwpJjAvvhYpvvFi/p:v9ADl++Qh8hF3dLNbJZIeiVFbdQ9cBxS
MD5:	3D8EC5640C9A814D8D26483D135E698B
SHA1:	15FFB7ECFA9260FF2F0439727D67897240653BF1
SHA-256:	20040EB12C4BDE67FDABA345DD18F5D5A55EB1D4BD0E634CC589B7E2C66E6A52
SHA-512:	3E39AA837EF2FF7F698CEBF88BB775CB2245902FD8E4702970EE8535CD54D953FBEA5178C99DB0B938C62ED5850E9495F93590689A2A5EEFBCB933D8739545A6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................I.....@....................................W.......................HN........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\he-IL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62560
Entropy (8bit):	6.538819459136321
Encrypted:	false
SSDEEP:	1536:ZO9CElFACr31NvYOv0ffLE2WGNFzw9mgCOppcdIUX/a9BcPF4O9M6XXfEik2uIsV:k9CElFACr31NvYOv0ffLE2WGNFzw9mgV
MD5:	09BB3D444935C528B480C492832BA992
SHA1:	17E54297103F0E944C93F4162BE18AEDB8EA0779
SHA-256:	85D0797D32892617197026ED00BFE1BB2FE9A07CD64390410133D5C7F430EA15
SHA-512:	FA0C1593080AB8AE0723108742824B3574A713F12C25C310A3AAAA4C862D821B86B90F80AE94B1CCCBA3FB5976AA4DA7D43837B634AC3377E1CF80B4F75B2C96
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ....................................@.....................................O.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P ..q...........................................m..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.469806225746028
Encrypted:	false
SSDEEP:	1536:ZO9dO2GxyJQPMKJUlRKXQu+aOdD68/8aEv8Fez74mwBxG211H/KqI+1EikdIsuzs:k9dO2GxyJQPMKJUlRKXQu+aOdD68/8aG
MD5:	80AFE9776BA5F8489BB61F385635B1CF
SHA1:	D518F36C5A4F00C5CA645F9BD21A79E0412E5974
SHA-256:	A63DE2AA929E57E502FCF8EE18F1875084E533AA8CDE337D69EFF020012057CE
SHA-512:	21EAC6874ABF12C7C182B35CB3C01178FC39F0C2E94BFAE4801A52F863C8A6D86E627F671A541B045A2C52154639A9D85014E142E18C776475020EB350D7558C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ....................................@.....................................S.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..^...........................................Z..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.516164435968868
Encrypted:	false
SSDEEP:	1536:JO9PebzfDSD12NfIBLCOP8mTtzDd0Wx4Ky6Vlm3KlbcGUYTo1f8Q8ZOQXOQ8M0Q0:U9PebzfDSD12NfIBLCOP8mTtzDd0Wx4N
MD5:	01A998681DAA1BFDFA695C533B8C2BB6
SHA1:	62D53791A965CEAAADEB8630E608A0D78667B2EC
SHA-256:	07FE7C4BFFC7713A0AB9DA12118512E9EE509EE14E603559B27E5DE346A53924
SHA-512:	B9AA272B473CED31DB1113B404263D054D5391D10C04453C2F48F6EA3BB36A81C1D8B5B1C67C43D13FFCA417AFD1825D0552E26DED0BB498E7A8FB76E674B51F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................~.... ........... ..............................?K....@.................................(...S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................`.......H.......P...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\id-ID\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.46059690688784
Encrypted:	false
SSDEEP:	1536:sO9NagPURiGTqSzcnYzsdxAeetb2YHEKTtWA16o3vPjBjtLP7bscEikksms/pzdR:Z9NagPURiGTqSzcnYzsdxAeetb2YHEKm
MD5:	23273432D5E925CA8B9CCE0EB6C0786A
SHA1:	5FDB8A49D4E4ACBD4D549F10F5F2D276795B560C
SHA-256:	96214337ABEC104DB82EE954B39D3D60F8B2182D51F0DE6135A628BCE6BF6794
SHA-512:	E3F204D03B5AF109209EAF53F1FBB2057E50D2BC09A6790AF9459FD6104BD981BA79886D46E70D92BCACA1165C1776385391F9E0017E7F17025263E9A0D6C4A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................^.... ........... ..............................g.....@.....................................W.......................`N........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................@.......H.......,...............P ...........................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\is-IS\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60512
Entropy (8bit):	6.501112106514937
Encrypted:	false
SSDEEP:	1536:bO9WAqYD97mcB1jaIJB8E3rTYSXxVG12uonduxkeU+BJRUJsQVr1i4EikrsYs5Lo:i9WAqa97mcB1jaIJBP3rTYSXxVG12uoI
MD5:	DF52D1A710E3DB3ACA1A79D7A9829F59
SHA1:	C10201F665058FA42A8BEBBCCF116125E8D1A1EA
SHA-256:	15BDA2260386923606A705541673483A76A545250D54EEE3BADE9F7949254906
SHA-512:	275F3DDD0A63C54BECBB14A7399ECDC7841929B43E6E192401590853EBDB8EFB78F495EFA27516CAC3BBDF0231F02BCA5F44EDDB6635F6FB9A079FC32E30FB8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................P....@.................................D...W.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......l...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\it-IT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.438594682971094
Encrypted:	false
SSDEEP:	1536:QO9P3y5h0Fp0NK/gRcFvoZ4FKKC2msifHLrEvI2UzpCwqPZHas2dyHTWEikrPKsq:99P3y5h0Fp0NK/gRcFvoZ4sKC2msifH9
MD5:	EFF68E098E6B5AC2EC5DB86D59F2F34A
SHA1:	0F63B1FEED689CF723AA5D1F7D89FDCC68025D47
SHA-256:	74BC14FB2097D47F0EEC22DFB9429A86C511B3AE55EEA6D771F7E9C9697ED26A
SHA-512:	0F09D415684665994C1DCC9AA74C59D5F2D8ED183A6E703D53BDEF08CAF830129D5949C7B7EC2E000FFDB7DB8AB8CF624F896875372C6559BC7FE4E9EB35FCAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................G....@.................................T...W.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......\|...............P ..+...........................................'..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62536
Entropy (8bit):	6.6524750201589455
Encrypted:	false
SSDEEP:	1536:UO9WeuzR+bLcQmuGuRuBG6v7yM5uGJ0HIc2N37cRAoXDuII5ZCUaxvEikkTszIzQ:B9Weud+bLcQmuGuRuBG6v7yM5uGJ0HIv
MD5:	4D740F1B35367259CCF7C3452FA9409C
SHA1:	8BF81202ED93FCDDAA91386EBC7FD621B4177BFF
SHA-256:	66F6D9189B9E96F50105B34EE7C83B13929E1FFBB225F0A59B11F05E692526CB
SHA-512:	3B78B3C4A4367B2F75DC53EBFE9304B6DCBEC7EB50C06F7810EF2779B19F724A2B2BC10E56842E34277663010ADCB485EA955071A273ED11D187CA047B8790CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................>.... ........... ..............................{9....@....................................K.......................HN........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......................P ............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.646946212587404
Encrypted:	false
SSDEEP:	1536:wO9WAqhvGiu7WCbAfU8Uvg2LKhiM3fYzsKNLz89SghOD/4Ke5XLjEikwF2sfazmN:d9WAqhvGiu7WCbAfU8Uvg2LKhiM3fYzq
MD5:	26A4813F1569907D6E86B960B988746D
SHA1:	439E5CDC1F971D0D286E2C44801E4DDAB63A7C8C
SHA-256:	C66D0B47609CA2584649FB9EAE85BFEBDE348ABC6FCFF10BA9039735A1AFDCCF
SHA-512:	DBAE968A9A40850585867431169DB1620D9D224D7FF6A7E37F2AC50DF5C7BEAAD339355993EF4B4DAAC469118998ADDAFD485ECE5A66439738352932DA37B15B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................^.... ........... ..............................p.....@.....................................S.......................HN........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................@.......H.......0...............P ............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.506165117406071
Encrypted:	false
SSDEEP:	1536:sO9B5vAqvshLrR3gUZO2A9oclmD1tdDnpRmtQH2QKDTLXosU2ex+nuY8ZEikgVQk:Z9B5vfvshLrR3gUZO2A9oclmD1tdDnpj
MD5:	3566373A90F09BA59EF4F7B1BA2A6FFD
SHA1:	FCBF1AC10A7191D471A2341845110E5572A204EC
SHA-256:	3365E80B1F4047773B510A5D0B6C0148DCB8D83F503F8F62833CE7BF8CBE9237
SHA-512:	0717C7855B2F66399FE367D58E971834122B8DFD5FFE6AA1D4FAB8F36C185A530D7B078BD420C6E54D93381521E15518FBB52C93BA5C38F0F29B94428EFC16B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................]*....@....................................K.......................HN........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.483761901779719
Encrypted:	false
SSDEEP:	1536:UO9jvyffWGiHpdYq84Ae89YJTrjz46UNhNnkGzColMa9TJERMCR+EikMnsCazydQ:B9jvyffWGiHpdYq84Ae89YJTrjz46UN8
MD5:	A71CFA89BB1AC26AE34B8D4815D6B8A6
SHA1:	B723CD73F03F7ED4D9366626525A69B868153016
SHA-256:	0D19FD402870D85278C10A70474A57DD1A4813656F13AFEDA006E04F4FFA6427
SHA-512:	EBD14080E66AD75CA1D4DCA6A792010C964950F6011B1B43DE9A50787AFA5898026A41DBE314409BB83D4F6F6F535AF7DA8181FA46B83861B14FE1186622E562
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................................@.....................................O.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	447560
Entropy (8bit):	6.69362725487304
Encrypted:	false
SSDEEP:	12288:J08z9gRInEQpdGpPkKDyhAm5IiWDfg2n5hUgiW6QR7t5s03Ooc8dHkC2esv:J0CdEQpdG2KDy2m5IjDYA203Ooc8dHkN
MD5:	77FA8A6193B1830D2235F48987AEA5B5
SHA1:	0B2044D6738773FA174653BB818F4A1FE76FAC89
SHA-256:	C2B2103289B656617D85EF90C04A2B8F9CD7CAB1778E69563F884C89D892AB5E
SHA-512:	29333B6AB895440E5157F1895E180CAA4181D5DCB387CB626D4FA45CB3818AEA9658DE0C16FB72678425B7694DA39817ED6EF6B45425F57035A00B9070E97B69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 2 .A\s.A\s.A\sr1]r.A\s.9.s.A\s.A]s^A\sO5]r.A\sO5Xr.A\sO5_r.A\sO5Yr.A\sO5\r.A\sO5.s.A\sO5^r.A\sRich.A\s........................PE..L...t%.`.........."!.........~...............0............................................@A........................`U......<c..........................HN.......6...W..8............................W..@............`..8............................text............................... ..`.data...L(...0......................@....idata.......`.......2..............@..@.rsrc................J..............@..@.reloc...6.......8...N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60008
Entropy (8bit):	6.477288189346955
Encrypted:	false
SSDEEP:	1536:/O9NAXZqHGnAfUPOMnwjxNK0/84Z1aBBX2dulK0rEyKpFbFK0qA5/0EikMqsjz3X:G9NAXZqHGnAfUPOMnwjxNK0/84Z1aBB7
MD5:	0060BF986FE2F438507B2D8726406384
SHA1:	25996C7B6C49A8554413FEAEEB944ADCA570B936
SHA-256:	F376F3B31E296801504C86EA92AA1A593D611805311E7E7710770FACE1A77AEA
SHA-512:	90E4B18611FCF5DCC83B077938A43283AA82239EC27D269ABA481F119FC394298985DB5E13D5616EB0F3E418F592526E56230E39036465F524C0D8FA29F681C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................b.....@.................................h...S.......................hN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..@...........................................<..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.460625681397577
Encrypted:	false
SSDEEP:	1536:fO9PR9q4u0ayE7tbVTGDyl5lr41AcUV3tbUe1FdFYWssYYzTRo+0W+zmtq6+D+rs:m9PR9q4u0ayE7tbVTGDyl5lr41AcUV3I
MD5:	37330ED5EA5EA01771D413C98FC32B7E
SHA1:	AA17C3B714F4550917A042F483054121B13B17A4
SHA-256:	C96FE685D8DD9A0BA9ED3B843FB69DC6722B179B765E028BE695AD1D8E06ED0C
SHA-512:	FA7DBC099A56690259C3B37E63A2C6A8D3543AB1058F27714D659FC3FAA827C1A960DC84CB2349CA6B24676FF3575AA61C8EA7D608FD5A5CD63024D6D74DF04D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................}.....@.................................P...K.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......x...............P ..&..........................................."..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60008
Entropy (8bit):	6.484690147146799
Encrypted:	false
SSDEEP:	1536:LO9NlqiUFxfhZjVqvA/hIlCsOdLM0SB3b6RCJmwc3fF1p3Ruoh9lF7+TmuB/BYSs:S9NlqiUFxfhZjVqvA/hIlCsOdLM0SB3s
MD5:	BFA3524BA2302E078FC4BB315DFAEF36
SHA1:	5B1DE08A1DD25F1E8A227AEF0FDA478C6C2B3D2A
SHA-256:	9C27243B849F4AEAE152B08728731529314F03B32B5B447197914BB134E67A9D
SHA-512:	FF0DA53C5DA977AAA2FED565F3BFBEA44E0E8D14E101F9E9CE0E49747CBDC69CD53CDB1AF68A756D28424499A80FE576A2B3FFF5DFE962A48134AD9B69C6C9B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................................@.....................................O.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62048
Entropy (8bit):	6.499608570162744
Encrypted:	false
SSDEEP:	1536:lO9YM3z1nR8zMuKIJycvcygytrpu8hYGNNxYjEF9dmPTKgMsGRis0xEikBmsTC4y:w9YM3z1nazMuKIJycvcygytrpu8hYGNG
MD5:	46CA3125CEFAA641DCEEC37735E99857
SHA1:	7479ADEE6400FC727B99647E1393F0BDEDD76FE7
SHA-256:	E91C7D8291B548B0C87A8DBF5BA4AC48B070A71EE2624177F40B059A8E920ACD
SHA-512:	D6CBFEC4B65328162C295C85142676BD87B0EDCC27016FAF53ABE0391E5586244CE95CC8DC5E7BF35282DA6753B89E18702D5ED2ED654E3E566301A546F0C2C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ...................................@.....................................O.......................`N........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..b...........................................^..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.481733244293592
Encrypted:	false
SSDEEP:	1536:yO9PD+Ztk6ONWg3iynOs5U1jkFhKwKH/PIPq7tzZtq93YcZ8+gGxlEik6nsyzSZL:b9PD+Ztk6ONWg3iynOs5U1jkFhKwKH/P
MD5:	754393FD72CE7072C9D1CFB811BD6890
SHA1:	09C0FA677E62AE7B73C9227199D73E8E1D3781E9
SHA-256:	2104377F7A6D91954814982B2D01D8FB1387242348752B4D74F8DC51CDA3DCCE
SHA-512:	2D13331E6E3CEBE88F5904506E766AE914216846BD86437E0064027C79A228B1A825167AC85AD7CF9B0E2A3184483D54E04FD3F760849A5EE95490E535AF72F1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................L.....@.................................\|...O.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..Q...........................................M..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61032
Entropy (8bit):	6.4636076325119385
Encrypted:	false
SSDEEP:	1536:EO9P3hKCp6OYLZur7K/Wwtzx9RA8YGsBo4bUxOhTeiuQKYGasX2iBEikQqsnzJAS:x9P3hKCp6OYLZuXK/Wwtzx9RA8YGsBod
MD5:	5FF2A9B976FAA2D6D77DED84DABB4F23
SHA1:	BFEB0050B14BFC5B19387A5B97E33B75A3810921
SHA-256:	79E68866A498DCD35F2B6E7034E41DAE5C4C941B8DE68129D95E42A5F1635921
SHA-512:	3B40156578215F3E41D3D03D6ADE09C4E1171B9A13EA8A9A918BE8CABBBB1D537964A2715FB0A10A8F74D20D7D096DF0173CBA62EF849436057B6B17093727B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................FK....@.................................t...W.......................hN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..K...........................................G..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.491906435239392
Encrypted:	false
SSDEEP:	1536:uO9PchEfYkIl57Dr3w8Zw9XS+xd2XHsdlEhm5AtmxhG7TcFzCQOnIxEikTQsUpzx:H9PchEfYkIl57Dr3w8Zw9XS+xd2XHsdP
MD5:	210D110E8FD4556BB6D5BADD157FDFAC
SHA1:	BFB4682C6C53208F17D29DF7C893EAAC8B2FFC45
SHA-256:	CE1F0922E083915A2FD9F386ED239CAC7EB7BD22D5F3646C89EBB43C59EABA92
SHA-512:	B09F834515872D35EC304116AF38EAD505DD4FAC8CB8689E770EE11DB706D73A06DE59999D376078B5869BDB592A6450C0479F4F183134EA6E971937D28A685D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................................@.....................................K.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65096
Entropy (8bit):	6.5757659638547805
Encrypted:	false
SSDEEP:	1536:7O9MFcYvxELwVgZIvKsk24cxu1XVwNCMRTid1j2rIgfdqI5TOfHtUw8EikGGUBsR:C9MFcYvxELwVgZIvKsk24cxu1XVwNCMi
MD5:	DAFF6FAD7BF7BCF89E924BCBB58CF945
SHA1:	D87DA98D42A22B1F4BFE3F67194B163FFB28BC01
SHA-256:	EE645F8D963A3143414F09C96149C39076B768B537A64EC0193D416B96A7147D
SHA-512:	C107F4616D81F83809CFA1B186E2303E958B0608EED4675153630312D8FF2826C28EF2075F072D7028149792B4CFA5E62261FD0C6971FD5B0E286BE88CA2F686
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................... ......_.....@.....................................O.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..a...........................................]..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\runtimes\win-x86\native\WebView2Loader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120392
Entropy (8bit):	6.600820147251668
Encrypted:	false
SSDEEP:	3072:kkutiJKARK95EvS8BBwwgZqoc5+TiEt9XS3RMlyTI:kJti4WZBBdZEt9Syld
MD5:	D98053D49BFE481CBC394439879278BE
SHA1:	53DC39C37D780D5D5CB3D341C77A304919362BBC
SHA-256:	25D0F56DF1146C34F59D291B62E34608D2F7451D817EFFE5E94147CF182ECF41
SHA-512:	3CF06146E31574D3C13C13CB6D887C3D66C5E4C47E3291C2B4F3D7F196786668BF257702A8B6D9047BFC986784EF756ED9B1048CF3C9058C129588C19E3F61C2
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......a.........."!.................;....................................................@A........................M_......?`..(.......................HN..........D\.......................Y......`................a..<....]..`....................text...o........................... ..`.rdata...n.......p..................@..@.data........p.......`..............@....00cfg...............j..............@..@.tls.................l..............@....voltbl.H............n...................rsrc................p..............@..@.reloc...............v..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61536
Entropy (8bit):	6.523136812660269
Encrypted:	false
SSDEEP:	1536:ZLO9gebhHq+ugsPXU6d/ic7SFgw0FAAgWwUT/8IS5RhOYPi5wt7D/TEikbss5zqJ:o9gebhHq+ugsPXU6d/ic7SFgw0FAAgW2
MD5:	E7991B70C6B77FEA9A62C4F8D7530431
SHA1:	CAE5F8E620566A0B88BEBB652CA05B6D488BD336
SHA-256:	9D57733FF03F65B3772E594C2B724516AAE07B36D278D95551ED0CF9C8E3FB0A
SHA-512:	1DFBC4E3D3DF1F096329CFAB20AF3DBE004914389723B72C0FD6C64524FCC0A62D00C9E1970E3AD4EFC5D290E1C3E3270835DC9DE833FF6DF42F8C935F75F1D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ....................................@.................................t...W.......................`N........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..K...........................................G..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.479386821033209
Encrypted:	false
SSDEEP:	1536:SO9mF2xWvZr5ttPBV5ramm5IgejsnMniPqhm+HFZUI8L0CmJ67V86o1n7EikSlIo:79mF2xWvZr5ttPBV5ramm5IgejsnMniu
MD5:	59B16C3C894BE415C7898631A56875B8
SHA1:	936B5488D3FA4A719DDB23E77349990F0B608B6C
SHA-256:	ECA7D7BEF9C766B58D52A9397950DFD255FD7CEEB6AD7F8A6FE40ADF8F4076C6
SHA-512:	3EEFD8BD4E3DBDE781211E21EE7D94ABC1B315DAB170AB6B7C54F50DD8F08423D89F3D31E72EAF55ECCD72F02B8C87CED43D6E0BA93EE9D5F737BB02BC2B009D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................Fm....@.....................................S.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..^...........................................Z..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60480
Entropy (8bit):	6.4782272527779154
Encrypted:	false
SSDEEP:	1536:sO9ADvQ094ML8I+w2zbtseqNaio1KHc4hUyFE4RlxgCwXVn03mO0OHc0EikbLs7h:Z9ADvQ094ML8I+w2zbtseqNaio1KHc4N
MD5:	7A93FD8F03D33164125609576B16F7D3
SHA1:	4E9A26CC292F32C46E7AF980138459BB54FCB5FC
SHA-256:	7E77C6DB4E49369E22745AFD1902D43B69B63EE3904C98092325101E8E175425
SHA-512:	5A7120AE9518A7DC17378589770C65EBB2500F49ECD61810CFCBEB92598A3A1B0759416063CC323F45A7F9F8C62EA8A5C652D29C7D61124F54C9A99CD9AC227C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................>.... ........... .............................._T....@....................................K.......................@N........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.465184220792856
Encrypted:	false
SSDEEP:	1536:WO9NbIMAwsK92xi/p6ZCXczFy597Zh3ndpqW7A7MlN9XXW0LlTcE56fvEiknAs3E:v9NbIMAwsK92xi/p6ZCXczFy597Zh3n0
MD5:	EE967F32CA275BFD2ECCCC4E7DF8B2A8
SHA1:	ECABCA1D011A740F7BD4A70455BAC993ADE65558
SHA-256:	3752413BF675863D6907E3D28CEE268F21F23DA7D867B03316593A93AD9342E1
SHA-512:	4CAB44A67A27A5D6DF49DC2DFC90B6445E7B1C42E8C877B77B56850EEB5CF15467D14956F2E549CF34DC2E806040DE7D1653A1E73371CFCB131C51C29B1C8E4F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...................................@....................................O.......................HN........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\th-TH\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70240
Entropy (8bit):	6.439305964283473
Encrypted:	false
SSDEEP:	1536:5O9f4A05v/3yGE0k4otwhknztUWCH34BsBrs+9XgaCTK6pO3/SNmKuREikFrsFaB:E9f4A0533yGE0k4otwhknztUWCH34Bse
MD5:	6427DDA9F993898603DE50DDE1528754
SHA1:	4737D69D4F8386C120DDA5A3718C31A7EB061453
SHA-256:	90951B5F5A58E50E3A1068FA9DD30D30F8257FC27D1586DC66EDC174559FE529
SHA-512:	B4925822276FDDED78553828384EA1A9016B49EAB38116FF0DC9748DA3DB1EEE5349C67586466BFAC29C8CDB1B10A4735ECD72E80A6AC427EFD834FC05B3623D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................... ............@.....................................O.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.505132466289463
Encrypted:	false
SSDEEP:	1536:lO9gSA64YW8K4MZQ00EOS4Lhq4YFfmKAZ2tWD5WtcRxzkebFbrLyXPEik6ms4pzd:w9gSA64YW8K4MZQ00EOS4Lhq4YFfmKAD
MD5:	E1C23198DA9715C0D8814AA42AD73F8E
SHA1:	CC56B69059EF89A9CE9507E9B71557C7FAF3EE86
SHA-256:	FC03EF162F1247354449D8B7CA9A0975A692E4C2571078BB00275EC40FB4DFF9
SHA-512:	5E4CB706ED60D7F20B5587D4D48F9634AA770BC6D482F380100B264C1ADDDA152D19E174DC1FFD7D1446A180DD805CDA4180C4FBC814C6D547606FE33FB2F870
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................q....@.....................................S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64584
Entropy (8bit):	6.578204708909461
Encrypted:	false
SSDEEP:	1536:eO97noksNVY4yQM8s8KU9oTU9j6qImAdgM3XRPW+292RK/1BI3HkkKajWhEikvri:397noksNVY4yQM8s8KU9oTU9j6qImAd4
MD5:	A788D43CA80284DE4B1F4BE99260CFFF
SHA1:	3399A53E1D923C8FF17A7B1708CC80976F205CCF
SHA-256:	A54192AC15BB6BAD9BFD1E0A1A958A768A7D2D942E489B4246A0A8D6194E6287
SHA-512:	3ABB11B0623A93C9EB4C654B9C8D7DCD9DC2BAA5DAE4B14ED86212C4F9B710F76E438140A405498F2A4AB44748ABF113CE50282BBD0B0483FB80368822142BA4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................n.... ........... ....................... ......._....@................................. ...K.......................HN........................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H.......H...............P ............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87112
Entropy (8bit):	6.939400200256647
Encrypted:	false
SSDEEP:	1536:0Ihq3RcCBwca4EZEXNciFk+ikPCpecbi/snazkZLzwN3A:0IY3RcCKcajodF4pecbi/78Aw
MD5:	BCAE3BAF0F089D495EBC8AEB278244CB
SHA1:	30E9D618650A9130743D44702B56D48EEFCDFC73
SHA-256:	6D6CD9AA3A3538F5C37A2BFDDCA9FC293AC3C05A4E708257BAFE2EB1AE49F1C6
SHA-512:	D76D22999BC7D79F4CC99FC3185CA074B8A3554412C5889BBD4497B1F2774761612791CBA4E58BCD97A38367AEB701ADCB0C5E249E0D3CFF005B19E78534AC49
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|R.\|...\|...\|..%....\|.......\|...\|...\|.......\|.......\|.......\|.......\|.......\|.......\|..Rich.\|..................PE..L...t%.`.........."!.........................................................@............@A......................................... ..................HN...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62024
Entropy (8bit):	6.590924628799334
Encrypted:	false
SSDEEP:	1536:lO9gwu6Q6WwlEaDcQwi2kBPcJ5kGvxF825mb6ZB+D31jnVJvWf6Qjlux6mnEikSz:w9gwu6Q6WwlEaDcQwi2kBPcJ5kGvxF8b
MD5:	2C89412B5843494388D50CBC904074BD
SHA1:	41B85F801196AAA600B3B151CF9D92B837580BCE
SHA-256:	9874B9B27E20695019D48F72700D973258E89909D6606FCA6E72B2F51E9F62FB
SHA-512:	180AA2AFDBEAC3FFD6509B6AB3EC9D436AB07324D690A3AFF18E977BE9E3046FD8E07A06024976A425A00EC28C1373786E95A74EBB24FC41623851BE2C34C447
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................4.....@.................................H...S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58952
Entropy (8bit):	6.660184048742961
Encrypted:	false
SSDEEP:	1536:iO9WbWCHB/rkbEqBAVidKSlcZSI3+B0ncFytfjCqpXFBwW8jeFLt8EikfBsl3z++:L9WbWSB/rkbEqBAVidKSlcZSI3+B0ncB
MD5:	2143E5B5A9E66E73DC29FB4E455C7F29
SHA1:	0A92DA431F4C9AC788DBFD5E99F0CB2B0AA7EEA0
SHA-256:	7CD1B59BE13DA24CA6881FF41076C37DE6182D636E72CFBAD7BD4C5FCEFC77A1
SHA-512:	D98C74DF96125C5EDCFA1C06E127DF75584D7778C739728E10BB3C857503FA526FE6309D45749C3DDFBADD9EFFE472C57EF78ED05DCB8A554BFAA6A64BB01F0E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................yy....@.................................d...W.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..9...........................................5..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59496
Entropy (8bit):	6.636021348116236
Encrypted:	false
SSDEEP:	1536:yO9WbWqDTFAyR6j4hxW50IEdIhR2Ji1paNSh0CvJaCuXaSQCHM7IXzDEikhBsm8i:b9WbWqDTFAyR6j4hxW50IEdIhR2Ji1pv
MD5:	1F0BE9447A686B051BDB75E34F0C8EF4
SHA1:	ED8B0B02E54334211D1DAB4E3215EDA1C909F0B5
SHA-256:	C6D50C31D3AC401DD787B7C9711969988EB552F7633B3D243800380470DDC78D
SHA-512:	2A6E73DAF00542959B3BA61B07AF8B58EF3008ACE112D277CF479060961DB59708D7FF53B27CCCEB54A2BA682DEACB5152B7F0B97625847A93554D24B7A26C36
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................{....@.....................................W.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P ..\|...........................................x..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\meeting-addin-install-logs.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	5.285245261093369
Encrypted:	false
SSDEEP:	24:ea1NLNHfhlmC8muS/PmiMaoLGvei7FLlRJHLOYCNFC4acTD/8YeTBjVFkEeOZ:eShNHfhlmC8mu+eiMFCei7FL9HSYyC4C
MD5:	351BF5DD782E01781CB7E1B11B459C2F
SHA1:	EFE01A6C313A5B1DAFF6322FA235183892CE47B5
SHA-256:	8737F6D5D42DE991120DE3A5547B4C445DEA72990FC19D9C780670001DF2C380
SHA-512:	9E964F302F4A2C9AD11407BC2E6AD035E747421D46CED6A1C7C7895C3FC00EE27E6C803CBCDC203559B7D8858FBFE2580EADBF95EBC8AC0EE0C26CB8F629C595
Malicious:	false
Preview:	2024-08-27-12:44:52.120 am System.ArgumentException: Cannot delete a subkey tree because the subkey does not exist... at System.ThrowHelper.ThrowArgumentException(ExceptionResource resource).. at Microsoft.Win32.RegistryKey.DeleteSubKeyTree(String subkey, Boolean throwOnMissingSubKey).. at Microsoft.Win32.RegistryKey.DeleteSubKeyTree(String subkey).. at Squirrel.MeetingAddinInstaller.<InstallMeetingAddinAsync>d__15.MoveNext()..2024-08-27-12:44:52.198 am StagedAppDirectory does not exist. Using Current..2024-08-27-12:45:18.826 am There is no version.txt. Falling back to getting version from folder name..2024-08-27-12:51:42.977 am Version: 1.0.24151.1; addinPackageDirectory: 1.0.24151.1..2024-08-27-12:55:54.378 am .dead exists: False..2024-08-27-12:59:12.746 am before cleanup unused versions..2024-08-27-01:55:02.971 am Addin directory exists. Copy was successful..2024-08-27-02:12:00.279 am COM registration. Regsvr Path: C:\Windows\system32\regsvr32.exe, Arguments: /s /n /i:user "

C:\Users\user\AppData\Local\Microsoft\TeamsPresenceAddin\Uc.tlb

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	455716
Entropy (8bit):	5.169510702747751
Encrypted:	false
SSDEEP:	6144:Rs3/0+NAoXAY6nuKGiUpXWFgXFQIY0EH7+0BJmmDAvQNRplh/y6woW0nFTF958lQ:A8CX0Qky6cp+7B
MD5:	E3C8B42670EBB0530EE81F427671AAA1
SHA1:	F8C75ABC800C7326E6E814947390C14575D691CB
SHA-256:	1B31630CD15BFDC663B9630790B968AEE407730DC94F48BB96FBEDAC9ECB1002
SHA-512:	4CCA913DD1890DBFA72195EFF3CB5856AC6C01A4A910DF719376EA13264E129823D3788EB874C222534AEE1E1CF7B3ACE71900002252449A872BB3C9447F3B98
Malicious:	false
Preview:	MSFT................C...........................y................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8...8...9..l9...9..4:...:...:..`;...;..(<...<...<..T=...=...>...>...>..H?...?...@..t@...@..<A...A...B..hB...B..0C...C...C..\D...D..$E...E...E..PF...F...G..\|G...G..DH...H...I..pI...I..8J...J...K..dK...K..,L...L...L..XM...M.. N...N...N..LO...O...P..xP...P..@Q...Q...R..lR...R..4S...S...S..`T...T..(U...U...U..TV...V...W...W...W..HX...X...Y..

C:\Users\user\AppData\Local\Microsoft\TeamsPresenceAddin\Uc.win32.tlb

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	455696
Entropy (8bit):	5.167372000083355
Encrypted:	false
SSDEEP:	6144:vtn/0+NqoXAY6nuKGiUpXWFgXFQIY0EH7+0BJmmDAvQNRplh/y6woW0nFTF9589k:98wX0Qky6wN/iZ
MD5:	2EB6C328ACE10BEE32EECB6609578AAB
SHA1:	3FDE2F845CF62FF557FD49E46FA6F761CFF4C7EA
SHA-256:	40F438A5F0D0E9FF5BBCAB29D51BC7B6CBA03548C5DB021A05426665A2F98A69
SHA-512:	E4FF466CEBA47C71046985AB1E62877BFC57D5A98F0E966C46F64FB23710C85CC2AA3BD2F4B0ABC134D18A501D7A01FFE881110FC57A8B5DDB07C89DCD4F3514
Malicious:	false
Preview:	MSFT................A...........................y................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8...8...9..l9...9..4:...:...:..`;...;..(<...<...<..T=...=...>...>...>..H?...?...@..t@...@..<A...A...B..hB...B..0C...C...C..\D...D..$E...E...E..PF...F...G..\|G...G..DH...H...I..pI...I..8J...J...K..dK...K..,L...L...L..XM...M.. N...N...N..LO...O...P..xP...P..@Q...Q...R..lR...R..4S...S...S..`T...T..(U...U...U..TV...V...W...W...W..HX...X...Y..

C:\Users\user\AppData\Local\Microsoft\TeamsPresenceAddin\presence-addin-install-logs.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	937
Entropy (8bit):	5.213697794713128
Encrypted:	false
SSDEEP:	24:J9fLmML7ICwYeMRJNiYeOYeMkiYeWlRJADW9B32SXZU8SFXgDYeqT1J4h:CMPeDeGDODIDW/OWTmkDwwDDqT4h
MD5:	AFF03EB23786227C3AFA5F8EC660961B
SHA1:	B73C51DF651F6C8327A68EC09FC618F207DDF6BA
SHA-256:	02382159F66CCB1EEEC8FD22947B6FF4F0A537133CC1C312708F0D97746DED1B
SHA-512:	5F8A8D8B153164362D15A7E7B8F4D14D10FBB19509FBEEBE18D6B6318A6CFC6E518215C570BA5D5315CDD1C996A9D77711CAABC7C1F266B9C8393BCABCC22727
Malicious:	false
Preview:	2024-08-28-01:44:14.965 pm Installing Teams Presence addin for Outlook.....2024-08-28-01:58:29.675 pm Copying C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\tlb\Uc.tlb to C:\Users\user\AppData\Local\Microsoft\TeamsPresenceAddin..2024-08-28-03:24:23.871 pm Copying C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\tlb\Uc.win32.tlb to C:\Users\user\AppData\Local\Microsoft\TeamsPresenceAddin..2024-08-28-04:33:20.066 pm check if UC TypeLib points to current\resources\assets\tlb\Uc.tlb..2024-08-28-04:33:52.508 pm UC Typelib WIN32 is registered under HKLM and file exists. Registration not needed!..2024-08-28-04:35:06.620 pm Registering UC Typelib WIN64 under HKCU.....2024-08-28-04:59:51.354 pm UC Typelib WIN64 successfully registered to C:\Users\user\AppData\Local\Microsoft\TeamsPresenceAddin\Uc.tlb under HKCU!..2024-08-28-05:01:32.365 pm IM Provider registry key already exists!..

C:\Users\user\AppData\Local\Microsoft\Teams\Update.exe

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2593968
Entropy (8bit):	5.881550107079208
Encrypted:	false
SSDEEP:	49152:V6vewRhIuY40qnnNjJDxn0YzcenyIoZ3v:V6vewRhIuY40qnn1JlFceyIu
MD5:	17927E3240D3B0212A4B93C1D45F92B0
SHA1:	D86116C18A4A5D409D38F3FAB45F3DF83E289829
SHA-256:	9A9F589DB0A8C6EF543AD6C85FAD3359C7CCCEF0D29EE76063F5B283A5ABB6F7
SHA-512:	DE72B0838982B506056D47C889A91E6144779F40167B1B26C09DFED50244AA73C12FA4D3C8C8EDA23E8CCC2246560FA16B186062ADDF7F438CAB60F003D3EDB7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Teams\Update.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................j$...........$.. ........@.. ........................'......%(...@..................................$.K.....$.\.............'..v...`'...................................................... ............... ..H............text...$i$.. ...j$................. ..`.rsrc...\.....$......l$.............@..@.reloc.......`'.......'.............@..B..................$.....H...........................X.............................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X*..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....%..{......................

C:\Users\user\AppData\Local\Microsoft\Teams\app.ico

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows icon resource - 18 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	172066
Entropy (8bit):	4.32521391566617
Encrypted:	false
SSDEEP:	768:Dg7Z3gHhMIW7F3TGUhxkZ1OgbC6kStqJ1L3mC3g9BQ0MRB3R9HwXOeOkccOOOOJW:07Z32hLWNTJhxiQACPStqzZw9ep3RV
MD5:	247D14144A313421D8D84AA0EA54D249
SHA1:	83BEFDD6EBA57FAA3D3074AA08A28A4E8D75076A
SHA-256:	2D5AA67B8ACE13A94FD09316787E3C9ABA2ADAC767B6E2AB769A2265A2AD20F0
SHA-512:	F2D79A2A75148EFAF90A4A92980E781B1F94A4A1034383FFE5749983085EF7EAFA29D4804094296B212795501B4B4A126BC47C24A91B60C24104BC4B24D99565
Malicious:	false
Preview:	...... ..........&...........(.......@@......(...6...00..........^... ...........*..........h....2........ .$5...8..``.... .....:m..PP.... ..g......HH.... ..T...i..@@.... .(B..R...<<.... .H:..z...00.... ..%...:..((.... .h...j`.. .... ......z........ .....z......... ............... .h.......(... ...@....................................................................................................................................................................................................................................DDD\|...\|\|x...\|\|\|\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L........\|.....\|@.............L...\|\|x..\|\|\|\|\|\|\|H..................\|\|\|.............................\|\|x..........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\LICENSE

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1096
Entropy (8bit):	5.13006727705212
Encrypted:	false
SSDEEP:	24:36DiJHxRHuyPP3GtIHw1Gg9QH+sUW8Ok4F+d1o36qjFD:36DiJzfPvGt7ICQH+sfIte36AFD
MD5:	4D42118D35941E0F664DDDBD83F633C5
SHA1:	2B21EC5F20FE961D15F2B58EFB1368E66D202E5C
SHA-256:	5154E165BD6C2CC0CFBCD8916498C7ABAB0497923BAFCD5CB07673FE8480087D
SHA-512:	3FFBBA2E4CD689F362378F6B0F6060571F57E228D3755BDD308283BE6CBBEF8C2E84BEB5FCF73E0C3C81CD944D01EE3FCF141733C4D8B3B0162E543E0B9F3E63
Malicious:	false
Preview:	Copyright (c) Electron contributors.Copyright (c) 2013-2020 GitHub Inc...Permission is hereby granted, free of charge, to any person obtaining.a copy of this software and associated documentation files (the."Software"), to deal in the Software without restriction, including.without limitation the rights to use, copy, modify, merge, publish,.distribute, sublicense, and/or sell copies of the Software, and to.permit persons to whom the Software is furnished to do so, subject to.the following conditions:..The above copyright notice and this permission notice shall be.included in all copies or substantial portions of the Software...THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,.EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF.MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND.NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE.LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION.OF CONTRACT, TORT OR OTHERWISE, ARISIN

C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2593968
Entropy (8bit):	5.881550107079208
Encrypted:	false
SSDEEP:	49152:V6vewRhIuY40qnnNjJDxn0YzcenyIoZ3v:V6vewRhIuY40qnn1JlFceyIu
MD5:	17927E3240D3B0212A4B93C1D45F92B0
SHA1:	D86116C18A4A5D409D38F3FAB45F3DF83E289829
SHA-256:	9A9F589DB0A8C6EF543AD6C85FAD3359C7CCCEF0D29EE76063F5B283A5ABB6F7
SHA-512:	DE72B0838982B506056D47C889A91E6144779F40167B1B26C09DFED50244AA73C12FA4D3C8C8EDA23E8CCC2246560FA16B186062ADDF7F438CAB60F003D3EDB7
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...u..e.................j$...........$.. ........@.. ........................'......%(...@..................................$.K.....$.\.............'..v...`'...................................................... ............... ..H............text...$i$.. ...j$................. ..`.rsrc...\.....$......l$.............@..@.reloc.......`'.......'.............@..B..................$.....H...........................X.............................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X*..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....%..{......................

C:\Users\user\AppData\Local\Microsoft\Teams\current\SquirrelSetup.log

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	431
Entropy (8bit):	5.426957819301689
Encrypted:	false
SSDEEP:	12:LSV/2HqhX3k8rJvTUxqhXORtmLMrJ9UxqhOv:LSV/2Hqhnk8rNiqheR8IrLiqhA
MD5:	6EA53333E31DEFB11CB5A7977D476101
SHA1:	389DD4764F70B8275452575E42FC1EFE6A8DE6A0
SHA-256:	E54D3B8C839A93D914DB32E2BE1516EF4B8D191D2FC26A9AB783872CDD599E0D
SHA-512:	2DEA109DA29339815FACEEBCC7D4B5588B199E153363D027DCF1BEE3F8398A934AB5B02E58385F192984578AED6F1356E525398123F96ACEDE971136DD39F0BE
Malicious:	false
Preview:	.2024-06-25 15:03:29> Program: Starting Squirrel Updater: --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe..2024-06-25 15:03:40> RegistryService: TryGetRegKey: HKEY_CURRENT_USER\Software\Microsoft\Office\Teams does not exist..2024-06-25 15:03:40> RegistryService: RegKeyExists: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Teams\ does not exist..2024-06-25 15:03:40> Program: About to wait for parent PID 3620..

C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	149481432
Entropy (8bit):	6.716505014109555
Encrypted:	false
SSDEEP:	1572864:jNy4BYkhf+H5oEUVrF1hlT/7Ryo3KqRG6i6vajQxnXY:pfNFTlDajkno
MD5:	E20A8E5630CFCAD496816E211D212EAC
SHA1:	71869C3475D5EC0CBBB74757EB1B42CE15637E01
SHA-256:	491486B1C1E9B93718F4D4ED8CD071D98622FD367B30B21836BD98DA60E8E0D0
SHA-512:	AD58F56CA67BA99ADE6FA1F077258DFD69A91BAFE2ACFC719D8127F44910DDC5A7C13DA974E300A3166318F210E28DDEB3B7D29A339AD181067C025E7678AA3B
Malicious:	true
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......c..........".......A...................@..............................#.....=v....`.............................................rS......\|....P......@..t);......M..........08.......................2..(.....A.8...........x........D.......................text...C.A.......A................. ..`.rdata....P...A...P...A.............@..@.data.....B......B..................@....pdata..t);..@...*;................@..@.00cfg..(....p......................@..@.gxfg....A.......B..................@..@.retplne.............6...................rodata..............8.............. ..`.tls....q............J..............@....voltbl.P............N..................CPADinfo8.... .......P..............@..._RDATA.......0.......R..............@..@malloc_h.....@.......T.............. ..`.rsrc.......P.......V..............@..@.reloc..............................@..B................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-console-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.174444396160522
Encrypted:	false
SSDEEP:	384:xzWRGWruVXC4deR9zVjjWPo5yEFHRN7N2R9zyvLMb:YaVXC4dC9zVj6PogElNK9zKMb
MD5:	D0002AC3A0BC9087FA04E87447402942
SHA1:	4C142D134613FCA50C5127EE27C91DB10832A813
SHA-256:	07E54F054F6A6AC5E79F8EDED53A6CE99CDFCDDB0FB85A24B59872D9A8BF3C82
SHA-512:	DB3FEAF9B1D2509645E4C8DC8681CD8B0BCC4510C4C677302636A0AE1F95B820EAC2C7542D478DB09963B6CFBB9AA644C51B3A37BA3CCB9201BBCCFAA562569B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...Y.=i.........." .........................................................0.......x....`.........................................`...,............ ..................HN..............T............................................................................rdata..P...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-console-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.200940877329348
Encrypted:	false
SSDEEP:	384:mzWRGW6z+egMR9zlN5nux5yEFHRN7vUM3SR9z+5u:j/eH9zl/cgElvUM3e9z5
MD5:	E0618DD3DD3C294A87899D4E38D7BF99
SHA1:	247207B2710462F355382AB08524B09D129CD439
SHA-256:	E7D250C4C35AF25E052AA1C97193A3E7882CADA7933524CA17915408CD6BF151
SHA-512:	01C4C6FBCB76E3B64F8BDA481338C0DFD36508F5DE1E4D96D757F169E4C96C2893FDFCCB139EA3038562585450EF65291F409E49328F7EA22E2DDA8160809606
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....y1..........." .........................................................0.......C....`.........................................`................ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-datetime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23112
Entropy (8bit):	7.181301188221551
Encrypted:	false
SSDEEP:	384:tzWRGWfnOXk02IR9zgahqo3j5yEFHRN7Eg2R9zyvi7:UHrU9za0jgElJK9zL7
MD5:	E7C549EA4C28379D8C45D4188812ADE7
SHA1:	57231F3F156333AB268841E7D93916B791412BCF
SHA-256:	C4D5D89F3C566E42F486177A2FDA28322DB3761D02AD229538FEDE837A41BE04
SHA-512:	6CA29AADFAB61ABA84A9B9B4ED9C05F4ADB6141914A79780E62D2701D12F107F5C852533BBF57BB4B1A6FC6433ACC88C4601ABEE9F0900DEEF0E07945E1CB983
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....Ab.........." .........................................................0.......1....`.........................................`................ ..................HN..............T............................................................................rdata..4...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-debug-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23112
Entropy (8bit):	7.196312063377219
Encrypted:	false
SSDEEP:	384:5zWRGW6OJTHFDR9zW6YL5yEFHRN7v/7R9zkV+az:wXl9zWLgElvF9z69
MD5:	45CC1DE492D880419183F68234972B3D
SHA1:	C834C86A30177986F4399D93A64FE6E87B600394
SHA-256:	68B3AB0CD1216C2780743C4526BA6226D497C7ACCFF491DAC34B5448820BB9BA
SHA-512:	CB5DC254C089681A768F335ECDCA6994DBF73F8E09F8471EA4D284768007E0AB674FF73751276665445DCE6567FCEDDD3BEDA22E1D350FA9669C9B66F78BFFF9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0.......g....`.........................................`................ ..................HN..............T............................................................................rdata..@...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-errorhandling-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23112
Entropy (8bit):	7.217690630029872
Encrypted:	false
SSDEEP:	384:/IfzWRGWbBMR9zlN5Xp5yEFHRN7Oe9R9zaOt6:/ICK9zlPpgElX9zLY
MD5:	16AA0D76C3A1EC8DC08CB2932E93A507
SHA1:	4ECFAA5F7ADD42958B5BAF6A6F28558217C94CE7
SHA-256:	013ACB72481888667E15DADDBA4BDAA1827BD9508B9A748518B9F3685F030512
SHA-512:	939B922EFEB2C4904D475E47E73D3D97438F3700B8699BE1B31D12E9806EF879823407D982511CDC5791748DB2AE56B0639DBD6895F1F142B2D0651B735152B4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....:.[.........." .........................................................0......YE....`.........................................`................ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	26696
Entropy (8bit):	7.116917589323945
Encrypted:	false
SSDEEP:	384:pBPvVXOzWRGWC7cVXC4deR9zVjjWHf5yEFHRN7qu/7R9zkV+:3PvVXbZVXC4dC9zVj6/gElrF9z6
MD5:	6F4F871C7B32CB14952B60D69D0C1C7B
SHA1:	E4DFCBE03E5A74C00ED1069471D86083C9401B4A
SHA-256:	3025C8819ADE6E9197CCEF3ABFD4A8539564563B48465856F1BD9E0E891E136C
SHA-512:	9591BB97DC0D51D38FD41145CA3CF80E73FAF6D9F69CACD4DEDDA15AE9A0EE4A84906F4B0747586C0CB35D7E73673C0EFC20E9B5309DB854F6316F99F9B35546
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................@......Y.....`.........................................`................0..................HN..............T............................................................................rdata..(...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23112
Entropy (8bit):	7.196076949295106
Encrypted:	false
SSDEEP:	384:+zWRGWkzcTR9zlPd5yEFHRN7RDcTR9zlxe:LdV9zzgElKV9zXe
MD5:	E168C4523329CDE399EA790C0AAF889E
SHA1:	8F3A99A8CA801E1607FE277CB26F519C7A1C953D
SHA-256:	2C5681C8606339F086B9D06BFA9E4E3641603654119B14DF73F1B94D2D199A2A
SHA-512:	7A625374AC3428858DB93E9D243B1774933AF8AB65E823238F5EFCD185D69DA6B16FA8F7142B8823DB71DF12E3F2B2634CE9AA4D560A79EF6D8E70C1E5323FBD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0............`.........................................`...L............ ..................HN..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-file-l2-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23136
Entropy (8bit):	7.243164617722081
Encrypted:	false
SSDEEP:	384:dVZzWRGWeCsB2IR9zg5LH/NEHRN7Tx2R9zyvM:dVQpU9z2FA9K9zn
MD5:	A9636D3D07B9DD7606DCAB9A33AE298F
SHA1:	0D1353387ECDC28E670275B231FF2AFB7AB6B155
SHA-256:	749A4402AF617F11437969CB1FB4110CA599A402F9D5014C811EB69ABC750D6B
SHA-512:	5AA9977179AD70A780860F8405C92CAF2BB0E65082274A5130ECE8CD76F3F4058DEE3C648C7DACE2EA0BE03B219FF86701C90A3D9A0E8A7D672FD95681C67B30
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0............`.........................................`................ ..................`N..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-handle-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23136
Entropy (8bit):	7.202557142593507
Encrypted:	false
SSDEEP:	384:LzWRGW6CsQFDR9zWC/NEHRN7KFDR9zWrloe:e5l9z3ACl9zc3
MD5:	BEAB6AA3ED4B0B449AFE6E6BDEE822A1
SHA1:	7FD06576C2DCE708C3D64C116BE0C6DF23FBA0CB
SHA-256:	EC7A2ADBBA4E77BFCCF18CC472113FBFB7520003A9CB0D9BD6A821371D1C8737
SHA-512:	B8C53DB5F5947A80BE1EF6879A3CEEFE1C6E799EDC6259C151657CFA73B2A59847DA24BA4BEE44DA6A65DA99C2144F10FED6423220F46DDE5B227C54E7B779EB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...>G.j.........." .........................................................0......jJ....`.........................................`...`............ ..................`N..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.174957979171288
Encrypted:	false
SSDEEP:	384:Ft6DllPzWRGWKyuSR9z+Ch5yEFHRN75N2R9zyvrJ:Jzue9zpgElLK9z2
MD5:	0259978F8901D27001727E74B4B15CDA
SHA1:	2B23D16D2D254DA485E45E186CC6BD568FC07132
SHA-256:	59A5E80872D0CD75717D75B90DC882E1BECFFF4842A3141CFDE244D5CFE3EB39
SHA-512:	98224C89561BCE0F8D2F221E005E33BAD73033304FDAF7150B4403D4D51EA2E1DCAC040A8FD437487DBD37AD1C2EFA2AC06193D2DB6BBF75813A8E02C3E8437D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0.......W....`.........................................`................ ..................HN..............T............................................................................rdata..(...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-interlocked-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23112
Entropy (8bit):	7.213048575122242
Encrypted:	false
SSDEEP:	384:kzWRGWKmrRxB+R9zBaJC85yEFHRN7WcTR9zlHh:dbRxw9zEgEl7V9zn
MD5:	1CC0818A4494B762D265B7B6774C5EF6
SHA1:	84EE200552987D8221E6DB2934FD228EDE5B8410
SHA-256:	9A558214911634F4FF6A936E631B14B7B87A6E922053B75899C61423D86C7731
SHA-512:	B73DEABA5B311D6D48A639E2BFCE03DC7C056B1677948BDE9E9AE5C3A328F47333C6D545D1E17FD119104A1BA19A703C0BCE273F1721E0C5E2B5A782986285E0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...*............." .........................................................0......._....`.........................................`................ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-libraryloader-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24136
Entropy (8bit):	7.16679417863342
Encrypted:	false
SSDEEP:	384:AvuBL3BqzWRGWuRMR9zlN51lyD+5yEFHRN7DeRxB+R9zBa2T:TBL3B3d9zlvVgElDeRxw9zTT
MD5:	E314DBEF15846336A20871FB4DEE6EA2
SHA1:	79F0625164375B6F0169291CED8D140D6FEF72D8
SHA-256:	6663264EF2F786A5120EDB8AFE0C0EAC487D5C21838259487B155376AC754F4F
SHA-512:	D8F4807100638A7C95B8BFEC1069E033CCCAC6AD76B2C2815880FBC6398A3D395EDAB8A78852FC1FFE90617DEB70CA4A8425FCEFCE180BB6410F9D39F530D5A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0......l.....`.........................................`................ ..................HN..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-localization-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25696
Entropy (8bit):	7.1828290910535175
Encrypted:	false
SSDEEP:	768:cOMwBprwjGzue9/0jCRrndbwlMe9zUAxEpw9zd4:cOMwBprwjGzue9/0jCVdIMazUAxEp4zm
MD5:	3240A43082BB601F3988279507D15620
SHA1:	45706512FCFA913AF893052D3C3FAC93C46320BD
SHA-256:	B18C6E612CF4696AC0D0BE04C41FDF26E5713C891B4C338D56ECE27E98040EDF
SHA-512:	7BF7FDA9905D1310C23812696744270608F30DB9D91EE9F5B659FD3C46A0A27466F9CDC994485F8721FAEBE09E690B4EDDC05CF924C29BA7530398F9B00B404C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0............`.........................................`................ ..................`N..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-memory-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23656
Entropy (8bit):	7.189070009610263
Encrypted:	false
SSDEEP:	384:RtzWRGWpCsLJEpcR9z0c/NEHRN7Cb9R9zaDxsK3:qhEpw9zPACT9zWxT
MD5:	A88D991121B74CAFAE2F7C48BD15B061
SHA1:	9DC684610D6EE43BA9D3325B6462A001BBD83C5F
SHA-256:	1B534C9F99C9F2A8C36804FC7D740FD9E1366ECF6A22327FBA23D75F88E7A8AB
SHA-512:	84E868857CC439E8F913D8B0CFD70395A55DA3B11EB79A0C6AA6039F65514DBB0EFA271CE5CCF41D936655B2D555FA8FDC82B1E328F02BA00442414CFF3CEF26
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...f092.........." .........................................................0......f.....`.........................................`...l............ ..................hN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-namedpipe-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23112
Entropy (8bit):	7.243599597259437
Encrypted:	false
SSDEEP:	384:6zWRGWehISR9z+/p2Ic5yEFHRN7bSR9z+xghV:HkIe9zgp2dgElbe9zlD
MD5:	FDC923E4384EBA7E6F3BCFC8DB5C8F35
SHA1:	CCA3CA492F5974D37E3A02CE51A0E39D546923F6
SHA-256:	AF64AB4E0F1FD2340E77E3E3010E55D6CDF4C436482816700EBED8CF4584AAD3
SHA-512:	1689387E87248E8AA4855C75C6F6B24742F66912535A3D4C25DB646B6B8EBFF1D4818C326D056D7178A2E9268CBD0E977BEDA80821F79526ECD5546A5F68D90C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....%..........." .........................................................0............`.........................................`................ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processenvironment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24136
Entropy (8bit):	7.172625162777062
Encrypted:	false
SSDEEP:	384:WBzWRGWN1+b/7R9zkV+P5yEFHRN7dP9R9zaCNO:PSF9z6SgEldn9zNNO
MD5:	829CAE9D55C806D43F167395CFC7D97A
SHA1:	BBD4F0D128E701226F7A2FCAB1BA3FEF4A883E9E
SHA-256:	9A377848E75E2B5929CC72E646F0B99624625F4AC047823BD013DB4CD221D6C3
SHA-512:	EA34C336F46DE11F0447EF731869D68C0118153587CF399F49A54A83D9AE8C56AAEE2CA252A3F748901AF0BDEADEBF74531CB128662A5064F1FF7FA8FC90E1B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0.......[....`.........................................`...H............ ..................HN..............T............................................................................rdata..x...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processthreads-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25696
Entropy (8bit):	7.110014308973341
Encrypted:	false
SSDEEP:	384:yWXk1JzNcKSIKzWRGWZaCsbRxB+R9zBafFIPF/NEHRN79KKJ3EpcR9z0XsZm:ybcKSmiRxw9zoGABVEpw9zlZm
MD5:	C8AAF6C93A1796A1B66CB2E89EBC8080
SHA1:	EBD5BCDF0CECF0DAA3A74DDD696DF9A668A1A652
SHA-256:	2A261D27DA75303EB318C4DE7D49770033B419A39E860B8CDAEDE3B17CA023DE
SHA-512:	03B8EC6A7434F2C3632DD55AF3586226636040650EDC99BF3D8D55EAE31F6573E519D14F7946686AE940D63FADB720D738753372CFC5FC28BFACE94AB0C3724B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...j............." .........................................................0............`.........................................`................ ..................`N..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-processthreads-l1-1-1.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.210782793165712
Encrypted:	false
SSDEEP:	384:+taDfIeAxzWRGWa7gpR9zLWVj5yEFHRN7CwSR9z+U:+DeAYKgD9zOgElCwe9z
MD5:	45773616BCEB4B551AC0D8853E603AA8
SHA1:	6012B20FC2443EDF0CCA0965F4738DA1B0048215
SHA-256:	54997C8846B97C8333104CF36AB278E15613B157C2432DDECEB70A4C4FC68113
SHA-512:	2E492E0064522E9689E747EE365EC6AADEF41BC10D36E64FEFDAC1D5829FA43AD84E95D3631473EADC8F97BAA57A390F748D5DD7C35229EDCCE3BC73DCEF5355
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0......}.....`.........................................`................ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-profile-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22600
Entropy (8bit):	7.264345997772862
Encrypted:	false
SSDEEP:	384:cvIHyZBzWRGWU1FDR9zW+5yEFHRN7BGXEpcR9z0D:cvCyZo4l9z/gElBOEpw9zm
MD5:	22294CD0DDCE5580A4A0395539D580F3
SHA1:	B7EA32124CA8282B49A219CA32B932D1F99DE1BB
SHA-256:	4CB90EF736EAF4AE7DC97E733EC957525F858C97F245AE6221BCEE4809336856
SHA-512:	CDAD732069FBD1637D3AF51268AD064BD693F4A4518327A499CB22A5B0B5DAF87BF8574D52007D1D9EC9747C1B6A740EDBD48376F1D6CD521B04F04ABB4B4FF0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....f............" .........................................................0...........`.........................................`................ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-rtlsupport-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.182115756506717
Encrypted:	false
SSDEEP:	384:8GeVyszWRGWPMQSR9z+655yEFHRN7SD9R9zac:8GeVA8Qe9zX5gElSb9zL
MD5:	AAA8F5A2444C359767E0263396848AD6
SHA1:	EE624F719EBEE50D01FAE9B009FBA5027A1971FA
SHA-256:	B9F5DC527CC7B17D6BEB55DA6B1E9C05C87B4D66CC05BB7964A307B4A3F91C60
SHA-512:	E37D4586DC56F2800CE7F8895D129262521AC909911008C26ECA2BBC30590B4C2558F3E515DF97895F05F73959A69993A214E934F7DF31FB52A393D2B9D5A3DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...._............" .........................................................0.......;....`.........................................`................ ..................HN..............T............................................................................rdata..<...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23136
Entropy (8bit):	7.222493904509621
Encrypted:	false
SSDEEP:	384:KyMvDzWRGW3Csx2IR9zgyyK3/NEHRN7p1/7R9zkV+tZM:KyMvmeU9zP1Ap1F9z6V
MD5:	6AC73C478EE2796DEEE862D04DA5D1CC
SHA1:	DC316BD0B6A76CD9D1CA107B97D1391A4BCDCEF2
SHA-256:	3B6B1DC9B1362A3F65D336EB3D93DB86215BF1FC78B27C42FEA2D39E10D066B6
SHA-512:	0B7F0AC1A19F91C5858EC9D0E3617C9721278D002F957744E110CE46EE43D1377AAA73CE17A7FD8CDAF3865BF6A1C0291DEF45153B833F9295166FF436B87CBA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....<.........." .........................................................0.......d....`.........................................`................ ..................`N..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-synch-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25184
Entropy (8bit):	7.14330146709302
Encrypted:	false
SSDEEP:	384:cdv3V0dfpkXc0vVatzWRGWvWCsHFDR9zWJTtIZ/NEHRN7g2R9zyvN:cdv3VqpkXc0vVaU3Ul9zihIvAgK9zC
MD5:	6410989141A05B2A96646E09BFE6AEC7
SHA1:	D3E5F4D322F4E69C5A992D45C57ADE1B9B2FB2ED
SHA-256:	074A64FAE175548CD0E6196D9BB2A9ABAF1B5DE53287C99FAEBCA85244DD2FF2
SHA-512:	847822C88C995F01198DFED370A01A86B3576C77E6B8A371F013C9E8370DC8580D350F009D898D02F8B58361AD23FB32EDF51167D1C0BFBAC83BE24D08AFF6D0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......c.........." .........................................................0.......@....`.........................................`...X............ ..................`N..............T............................................................................rdata..\|...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-synch-l1-2-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.227422005057757
Encrypted:	false
SSDEEP:	384:3tZ3CzWRGWaSYSR9z+i14v5yEFHRN7lW2R9zyvF:7fYe9zIvgElgK9zC
MD5:	476A1AB6916DA4756CC4C545218409A5
SHA1:	213499186DCC2CC0F5A05C1B099B97B4CF65B82C
SHA-256:	C6CBC8A7518496125067ACFA244574C44B59171230511FC2D532E064FC5724A8
SHA-512:	C21DA7478BBD98AD52B1EAF55A6428B260438CEBA0814557F9D9645EBE8B5C005714F611CAF3A3C9E9678907B5F88E438DFD77B6AD7484FDE23B79A9BDB64D25
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0............`.........................................`...x............ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-sysinfo-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24160
Entropy (8bit):	7.1730231716832185
Encrypted:	false
SSDEEP:	384:RcZzWRGWpCsrRxB+R9zBa0gn/NEHRN75/7R9zkV+n:RcQXRxw9zQA5F9z6K
MD5:	3EA6993D1503E30B4D5EE8BE9BB40900
SHA1:	FDF73717F51148D4E0722C4BCE906556818D68B6
SHA-256:	7C3752E068F8A60BC18194E8CDF76912075FB4D49EED3C0995287DC627E1AB67
SHA-512:	8D2B0C1F195F68E112B61D891B395963C6342E92FAD14EED49DA4A8B6F030875E8133051E2613AAD2F6279CF4A6494A4310F32F52E2E0D3395991405FC6FBD80
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r............" .........................................................0............`.........................................`...H............ ..................`N..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-timezone-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.223686553227958
Encrypted:	false
SSDEEP:	384:2fzWRGW1E/mSR9z+nb5yEFHRN7Zew69R9zaI:XHe9zwbgElZewq9zt
MD5:	A9A350098F89B2C821338A37735828BC
SHA1:	7F4113015729FD162513C86FFCF1C174C2758079
SHA-256:	FEB96978B504844143E49BEE444AD5E2D22857C4FB4448C5B5E3D1415C349AE6
SHA-512:	1DDE16A47384109193049204FE24AABEB982EAA29A57FB9ECF1F579421CDAE89CBD8B90CA7B38D02C9378EF84AB6578AF1DFCFEEA59374C0B4C2E5F06D7E75B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d....Y$..........." .........................................................0......M.....`.........................................`...H............ ..................HN..............T............................................................................rdata..l...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-core-util-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23112
Entropy (8bit):	7.194468178804502
Encrypted:	false
SSDEEP:	384:Ze8szWRGWVhYMR9zlN5fh5yEFHRN7Y42R9zyve4c:TN59zlXhgElY4K9zp4c
MD5:	5530AFA8FACFC47DAB2D6ADC9DCEEBEF
SHA1:	F953ADDD2CF227939D244B1E61C957B96C617165
SHA-256:	723B5A58D407DDEAC55EBD11EE106295ADAB766B04F5B5E2E225FCFD60187299
SHA-512:	15FC358D78D4675EE1833AA27E03CC15BF12D666E5D7FDD6272CB42F3E244F071B91788C80BA7C456961B8C013C397D227208D34550D1EFF7EDBFE95BC256832
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................" .........................................................0.......A....`.........................................`...<............ ..................HN..............T............................................................................rdata..\...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-conio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24136
Entropy (8bit):	7.189200458077549
Encrypted:	false
SSDEEP:	384:3PzWRGWY1O/7R9zkV+Zd5yEFHRN7Lg9R9zat4D5A:3yQoF9z6udgElU9zTVA
MD5:	84DE981752F992C79751D67BDE13CCE2
SHA1:	2729F7EFF940BD65811CDCB52FF03278D740EB93
SHA-256:	6A8F0C174C2D96D93FE246EC33315CA30451C06296C10C05C9985955CAACE45C
SHA-512:	A999D93720D3D4C7A5EE1372DD803A45B9C0D17D2EEA9380D1C1BF6AC3BB6011561FFAE06102FA9883EC26A3C9D9982D8CB46457201945EE43199D3AB3BB560A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d..../}..........." .........................................................0............`.........................................0................ ..................HN..............T............................................................................rdata.. ...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-convert-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27208
Entropy (8bit):	7.042915943147228
Encrypted:	false
SSDEEP:	384:l0wd8xyMzWRGW5JEpcR9z0g5yEFHRN7BbEpcR9z0HK:ljd8+nEpw9zfgElBbEpw9zQK
MD5:	CDCCF0188A00E26482F6413886BDB9A4
SHA1:	D08A49BDF83A0928BF5E792E054215C36060A7AF
SHA-256:	C241719B3958C72A34ABFC7C4B6D151834712CEDE7CDC1A3E82EC3F1FDB3CBAF
SHA-512:	F09189C2EBD84102FC9BEE54325C9BD0258F46070C4570F7256D59459B3132C2B5BEC7451BFFE563A9B7EBC12B635200F9E7B9FEAB322C7D22C22D0AADB9FAC6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...x............." .........................................................@............`.........................................0................0..................HN..............T............................................................................rdata..............................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-environment-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.1788281058286145
Encrypted:	false
SSDEEP:	384:tKNXzWRGW4iKVXC4deR9zVjjWIh5yEFHRN72v5MR9zlN5HK:7wVXC4dC9zVj6IhgElT9zlPK
MD5:	145FC41E1F3F859B82BA6C4F045D2C33
SHA1:	F3578E05E1EF502F6D9B6C91F208C51319FF8918
SHA-256:	FA53452212E8C3BD53E62A329EE21D7DBCB719AE2C9C3D365688A9579BFAF8D6
SHA-512:	3519E738719B5B12EB9279AD568A75EE971456CBC4FE368D4BB0378346C3BAC8E68D79AD0116AA5ED0A2122E0EE511DF5B3401AD8B7E7977E873E5A7728EE982
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...g P..........." .........................................................0............`.........................................0..."............ ..................HN..............T............................................................................rdata..R...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-filesystem-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25160
Entropy (8bit):	7.1780123814666075
Encrypted:	false
SSDEEP:	384:snWm5CkzWRGWAi2R9zyvNwPP5yEFHRN7P/7R9zkV+/fz:snWm5CdFK9znPPgElPF9z6c
MD5:	40D910493F9A03E2996B60EB59E5C237
SHA1:	7653F1B5609DF46B21099E066A5A1AB54A6A1B31
SHA-256:	E533403320EAC2032F962A6986C39F588E6632E59943E407000F54D6F13FE103
SHA-512:	D813CE129D2A0014AE02D2A0DFC8715D8285FCB2768B1CC7685FDDA7D4F0BECB8D3298B8E0078769E421AFA8AA75ABA669A1610028C8765B1E869D52917D85B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...r..x.........." .........................................................0...........`.........................................0................ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-heap-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24136
Entropy (8bit):	7.157691565210602
Encrypted:	false
SSDEEP:	384:+adszWRGWZm2IR9zg+oh5yEFHRN7AY/7R9zkV++r:+adVnU9zmgElAYF9z6Pr
MD5:	C7F414F860F9F3F1B1F3EC062B9C1FF4
SHA1:	8C14CA36AE9FEBA453B9D267BAC6D198A09F333E
SHA-256:	BEBB0AECB8FC665BA17185C24A764C7952515E82B70611A0E4E8D630C791B14F
SHA-512:	C05F756DA3CC71AF0BDB4F6C28B72ADA03B334E3303C7EA48593C73F58736B2F06BD8BA32F72F1FF1481493C7E14C93A2609A05FC5DAA6A0EB4371BA6F174E42
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...h{............" .........................................................0.......O....`.........................................0................ ..................HN..............T............................................................................rdata..F...........................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-locale-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.221408296814259
Encrypted:	false
SSDEEP:	192:YzWRGWfWEXCVWQ4+W+j0N8RwX01k9z3Aj7/J1WV8yk/yEFHnhWgN7acWU6Z8RwXN:YzWRGW0+N9R9zaDN5yEFHRN789R9zaNM
MD5:	266CDB104326C6A1FFEC94ECAF6A8CF4
SHA1:	423530D7A43176787D6DE4401ECE72505EDB5E77
SHA-256:	93ACAB0F7385797C56F2538AC7A97723F5A6EBE5FE1B363768D2B2D913D38435
SHA-512:	151F39466C26FD0AB76B9E7163D796129FABF96FCA5208F32E182B842EFC6324C9AEBAC66BC4047020A89141ED0F468F445384DC4A3138B1D7A88BA55BE4CB01
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...+P............" .........................................................0......x.....`.........................................0...e............ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-math-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	32352
Entropy (8bit):	6.857497263456227
Encrypted:	false
SSDEEP:	384:xSJI2M4Oe59Ckb1hgmLozWRGWFCsx2R9zyvL/NEHRN72tMq/7R9zkV+2Jv0:xSi2Mq59Bb1jh5K9zYAKMqF9z61Js
MD5:	8742222344EFA9BBD99EF36C879334B1
SHA1:	7CFF41E1A1BB5DE16F060D02EE86586CA2B4778A
SHA-256:	F396D8F04DAFCCAABF5D1C67D0FED4237627EA3F597C95F20394EA2C21761E50
SHA-512:	C9FAF8E15EC9C9DB7A7009D5B811214A63F0636DF412C64846F34A903C27090A1307FF81994C4720FBE85125E785D9E2E4A9E3C5A9FE75877E186EDE715756B3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...IV............" .........,...............................................P.......Q....`.........................................0....%...........@...............0..`N..............T............................................................................rdata...&.......(..................@..@.rsrc........@.......,..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-multibyte-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	31328
Entropy (8bit):	6.872482833246212
Encrypted:	false
SSDEEP:	384:ESrxLPmIHJI6/CpG3t2G3t4odXLozWRGWcCsn+TcTR9zlDz/NEHRN7AlFDR9zWLR:EiPmIHJI674V9zbAAXl9z2
MD5:	2367215632A93CAC9CFCD3DAA893CB82
SHA1:	7F7962F617E2CBCC2CEA9E666C5D9D61CF8689DC
SHA-256:	915187CBBC8500400D52AC85FFE338A41D3989704CBFFD0F00B048E849D371E0
SHA-512:	A882406C0863347B78D4E262E58D8E63D2CB2CABA43E8AFD93C3DB673DBD19273D6D7F4613B68ACDA960AEB71199861F802FB592C43EEE0563F1B0682CF6D83F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.../..N.........." .........(...............................................P......^z....`.........................................0.... ...........@...............,..`N..............T............................................................................rdata..$".......$..................@..@.rsrc........@.......(..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-private-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	75872
Entropy (8bit):	6.01152316524474
Encrypted:	false
SSDEEP:	1536:be6De5c4bFe2JyhcvxXWpD7d3334BkZn+PEXnzXA6kEp4zS:be6De5c4bFe2JyhcvxXWpD7d3334BkZ9
MD5:	2C6C33CE1FB9216CEFD347198EFD8D00
SHA1:	7A1954B5CAE412BCC63B030136A6A7BC753F2403
SHA-256:	3A99B386A1635744F8483FB6FA2B26C6B1CBC7123C8FA448BFB3A872C65ADD35
SHA-512:	3F681E51C146F1A7EDE373950757C235EF5AB4EB331F9E60F6F0213EF26CE80A63ED8677D91848A0B0024EECC3F7E1FAE04B4A023CEAC24B3290506A87B544F3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......F.........." ................................................................p;....`.........................................0...T...............................`N..............T............................................................................rdata..............................@..@.rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-process-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	24160
Entropy (8bit):	7.177589302964185
Encrypted:	false
SSDEEP:	384:Fn3zWRGWMCsORxB+R9zBaA//NEHRN7KR9zCjfBonP:0LRxw9zBAm9zwZoP
MD5:	44B114E7B57D21CBBF11422C17AC002A
SHA1:	74DEC251E08E4C35F795F526D5711C4CBD2B300E
SHA-256:	AC64FE40F35C8D8AB16AC36DAB0DE60CFD6D3741B7CC174F35BDE0A560CF017E
SHA-512:	EE89B7521AB2373271F9A88615803D6D11213BDFA6A046E1F14343C07DAD6A42FC20392505B459424C766313AF6DDAA6876FD9D4C2851F0B58BE706EAFB838E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...P..D.........." .........................................................0......h.....`.........................................0...x............ ..................`N..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-runtime-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	27720
Entropy (8bit):	7.047725056203447
Encrypted:	false
SSDEEP:	384:Plbr7SzWRGW1WjgAR9zCjnFK5yEFHRN72og2R9zyvVO:Plbr7PL89zwFKgElIK9zP
MD5:	6ED27B3BCCE901E0622F4112AF1C8D7B
SHA1:	3A21BE7B693E4D4D253CB26F7E8D33AEE99410FE
SHA-256:	B0E4272D626C4483C2C0A9E443AE274DD4CAD5B68E027857A7EEAD108ADB6F9E
SHA-512:	F2597B05D5418B74863B5B418C0B321A1D52C9DE0B6A70434AB78E4B94A1B25FF00143F277F614957099F46DA101166FC8E9DDC2296F342C3223C2367384DB26
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d...9..b.........." .........................................................@............`.........................................0...4............0..................HN..............T............................................................................rdata..d...........................@..@.rsrc........0......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-stdio-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29256
Entropy (8bit):	7.000687723738414
Encrypted:	false
SSDEEP:	384:s19OFVhmzWRGWtPfFDR9zW8v0eL5yEFHRN7HUR9zCjYmInO:o9Od1Fl9zLv0eLgElHY9zwYq
MD5:	39131F1E1E994C2B2FCD7D78EF808B6F
SHA1:	77A5380B8C66ADDCCEF316BB224DC78F3202CD61
SHA-256:	64E7B4898594766AEFB83E59771A1EE777A77B99026896098DF380B627C5A48D
SHA-512:	6EFCA0B69EABC300C0F23F580449CBE0C11BE0106F08156659FB56412B0E59F976A83A2CD6CF7F836913ACB89307A277C94D9A95D21B73C64C0F299967EDC6D9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....v..........." ......... ...............................................@......)]....`.........................................0...a............0...............$..HN..............T............................................................................rdata..............................@..@.rsrc........0....... ..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-string-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	29768
Entropy (8bit):	6.9375892183895935
Encrypted:	false
SSDEEP:	768:K5yguNvZ5VQgx3SbwA71IkFcL9zl6WkgElXUe9zLiJ:K5yguNvZ5VQgx3SbwA71IbhzQxZXUaz8
MD5:	742CC3B0AE272AA64DF3B012335653FA
SHA1:	BAC2BBCED00CCD5902ADE25C048E618C28BACE92
SHA-256:	BD551F907397969886EFEFE84C3534C5C39713FE79B5ACFFA944B138E821A92E
SHA-512:	76F93A3E205C637E391CF1BD129EC5D000C5A5425411F4521A7BC3DA8C87967F4DEF8BE4E87A54CEE8AF358A5543F93DECB19E6430721FD339DE4F0A466493BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d......e.........." ........."...............................................@...........`.........................................0................0...............&..HN..............T............................................................................rdata..............................@..@.rsrc........0......."..............@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-time-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	25696
Entropy (8bit):	7.126651249340184
Encrypted:	false
SSDEEP:	384:XUPzWRGWsCs80RxB+R9zBaxK/NEHRN7YFDR9zWR:kyX0Rxw9zZA8l9zG
MD5:	7817933C5290B3F2EF42F5D545B58C03
SHA1:	58E8EC6BCDC186D00D34A8DE115FC05503C31861
SHA-256:	81757DF94C5077AA1A2748A5C38C62548E8542A558D754B67EF53EA2340E0AA7
SHA-512:	16BA82FD33FE257DD97F888D95760DB3ACBCFD131AD6AD9159F7298FACC9F6DE95B74EAAFCC5B3CA8A4BB2A059039796CE90060DD21AD921302D738070392B01
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d................." .........................................................0.......,....`.........................................0................ ..................`N..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\api-ms-win-crt-utility-l1-1-0.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	23624
Entropy (8bit):	7.210971806691212
Encrypted:	false
SSDEEP:	384:AfwzWRGWe+FcTR9zlGlU5yEFHRN7wXy2IR9zgWuD6:AfZMV9zYWgElsU9z9
MD5:	367F393D23E75A44E1D33DCD0D991E90
SHA1:	699A15865C3686D8563CA90F8007BE430A740B3E
SHA-256:	6A72D3B4825C0938F1BA79A1ED05A4BAB9A3B4453BCFD928B85D0893F5D47B9D
SHA-512:	81E231DE41A28584D2E92B5B2ADD8CB4C4259700DFAE32348FFB538E36ADEAD2856427688C39D1FB92B8959D99B85FCA3EAECF16F00BB9C734D1F5A1CCF317C9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........&...Ge..Ge..Ge../e..Ge../a..Ge../...Ge../g..Ge.Rich.Ge.........................PE..d.....t..........." .........................................................0......Fk....`.........................................0...^............ ..................HN..............T............................................................................rdata..............................@..@.rsrc........ ......................@..@................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\chrome_100_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	128506
Entropy (8bit):	7.919136270123796
Encrypted:	false
SSDEEP:	3072:ogKzwI/4wKN3/nXCWZQCPxBVO2o418Gb0+VRLf0ld0GY3cQ39x2I:ogKzwI/49NPyCtoK18Gb0OV8ld0GecQ1
MD5:	0CF9DE69DCFD8227665E08C644B9499C
SHA1:	A27941ACCE0101627304E06533BA24F13E650E43
SHA-256:	D2C299095DBBD3A3CB2B4639E5B3BD389C691397FFD1A681E586F2CFE0E2AB88
SHA-512:	BB5D340009CEF2BCB604EF38FDD7171FED0423C2DC6A01E590F8D15C4F6BC860606547550218DB41FBA554609E8395C9E3C3508DFA2D8B202E5059E7646BDCEF
Malicious:	false
Preview:	..............b...#.....:.7...4l^...5l$...6l....7l....8l....9lN...:l[...;l....<l....=l7...>l....?l."..@l.-..Fl[9..Gl.;..Jl@<..Kl.=..Rl.>..Sl.D..Tl0J..Ul_L..Vl.L...z.M...z.O...z.P...z.S...z.V...z.Y...z.]...z.a...z\e...{&i...{Yj...{.k...{?m...{2n...{.n...{wo...{.....{..................&.....#.....^.................G...........W...........".................D.....!......%.....(....%1.....5.....>.. ..H..&..M..'..N..(.{W..).._....`..+.Qb..,.2d..-.Xg../..h..1..k..2.8m..3..n..4..p..5..s..6..s..7.-u..8..v..:..z..;..{..=..~..>.J...@.....A.....F.....H.....I.....J.$...K.)...L....M....N.F...O....P.....Q.z...R.I...S.....T. ...U.....V.....W.~...X.@...Y.....Z....[.....\.X...^....._.....`.....a.w...b.A...c.....d.....e.....f.....g.....j...................U......... .J...!.t...".A...#.....$.....%.1...&.y...'.....(.....)......>...+.....,.A...-.......W.../.....0.p...2.....3.M...4.....5.'...6.y...7.....8.....9.....:.M...;.....<.....=.k...>.....?.&...@.....A.....B.Q...C.....D.)...E.y...F.....G.5...H...

C:\Users\user\AppData\Local\Microsoft\Teams\current\chrome_200_percent.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	179027
Entropy (8bit):	7.942382041600103
Encrypted:	false
SSDEEP:	3072:YDQYaEqQZUYUJP1N3/nXCWZQCPxBVrfR54x5GMR+F44ffbdZnYw9p4AbIVGYoDdR:YDQYaRyY1NPyCt9gx5GMRejnbdZnVE6j
MD5:	D88936315A5BD83C1550E5B8093EB1E6
SHA1:	6445D97CEB89635F6459BC2FB237324D66E6A4EE
SHA-256:	F49ABD81E93A05C1E53C1201A5D3A12F2724F52B6971806C8306B512BF66AA25
SHA-512:	75142F03DF6187FB75F887E4C8B9D5162902BA6AAC86351186C85E5F0A2D3825CA312A36CF9F4BD656CDFC23A20CD38D4580CA1B41560D23EBAA0D41E4CF1DD2
Malicious:	false
Preview:	..............b...#.....:.b...4l....5l....6l....7l....8l....9l....:l.%..;l...<l.-..=lQ5..>l.9..?l.A..@l8X..Fl.n..Gl.q..Jl.r..Kl.u..Rl.v..Sl6...Tl....Ul;...Vl.....z7....z"....zL....z@....zE....z.....z.....zw....z)....{.....{2....{....{.....{.....{.....{P....{.....{............d......%.....'........./0....K;.....=....HE....+L.....Q.....W.....]....._....Td....=h.....q.....u....e}....V......... .F...&.....'.,...(.....)......`...+.....,.....-...../.....1.....2.....3.....4.....5.....6.....7.....8.....:.....;.....=.....>.....@.....A.....F.....H..+..I..,..J..0..K..5..L..7..M..9..N.R:..O..:..P.\|<..Q..>..R.o?..S..A..T..B..U.DE..V..J..W..N..X..V..Y..^..Z.mb..[.&f..\..k..^..q.._..s..`..t..a.$u..b.Hv..c.iw..d.]x..e.1z..f..{..g..}..j.S.....M.................j... .....!.K...".$...#.z...$....%.8...&.....'.....(.....)..........+.....,.....-.3......../.d...0.....2.....3.....4.....5._...6.....7.z...8.;...9.....:.9...;....<.3...=.....>.S...?.....@.*...A.....B.....C.....D."...E.~...F....G.R...H...

C:\Users\user\AppData\Local\Microsoft\Teams\current\concrt140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	327264
Entropy (8bit):	6.352604973329644
Encrypted:	false
SSDEEP:	6144:ft219yeaeO+1g29918EBf2wFrwtngwui28zinWVnWzgBoGgHH:1001en92EBfUx8zVH
MD5:	0FC84D0EFF188B66D7B784855503108D
SHA1:	0884F732919030BCD0A78864D114A40606E6506A
SHA-256:	938FBD62D8D329B126351FB73DBD7FAC6044BAA0257FBCB43C2F9D3CA2CAE1EA
SHA-512:	8D892E8FCB088046CB59A7363995F93396711246EA6DA3E8A47F68022EB774872A02729D1E7C803CB81A4AE4BCEBC0503B0B717FEEFD2065CA44A65DE9A987B8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........9.R_X.._X.._X...*..]X..V :.UX..?"..XX.._X...X..?"..WX..?"..[X..?"...X..?"..^X..?"V.^X..?"..^X..Rich_X..........................PE..d......n.........." ... ..................................................................`A.............................................M...+...................6......`N......x...p5..p...........................04..@............................................text...\........................... ..`.rdata...M.......N..................@..@.data....@...@...:..................@....pdata...6.......8...h..............@..@.rsrc...............................@..@.reloc..x...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\d3dcompiler_47.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4902496
Entropy (8bit):	6.40052955000265
Encrypted:	false
SSDEEP:	49152:9uhjwXkKcimPVqB4faGCMhGNYYpQVTxx6k/ftO4w6FXKpOD21pLeXvZCoFwI8ccQ:xy904wYbZCoOI85oyIn
MD5:	DCB281D387E892965255F222C1A5E267
SHA1:	D0D0950A76028E65C9A529F506FA4EBBC1F67F55
SHA-256:	1BC4CF7AC7729736300F98541EBCA25AFD0D0D476A59FD16722A6673473B0178
SHA-512:	EBA9AE1A469E045848E243A5FB9252F06B8C2278FB55E909BF9903E1EF9244854E3E9EF1C064442F1E9F255CF350935DA9F1751836109DB352C3AFD1DCAC35F4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...........c...c...c..Z....c...c../c....7..c.......c.......c..Z....c..Z...bc..Z....c..Z....c..Z...6c..Z.[..c..Z....c..Rich.c..................PE..d...-L............" ......8.........`.(...................................... K.......K...`A..........................................F.x.....F.P.....J.......H.......J.`N....J......vD.p.....................<.(...P.<.8.............<.(............................text.....8.......8................. ..`.rdata...=....8..@....8.............@..@.data...@.....F.......F.............@....pdata........H.......G.............@..@.rsrc.........J.......I.............@..@.reloc........J.......I.............@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\ffmpeg.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2820264
Entropy (8bit):	6.701611295786165
Encrypted:	false
SSDEEP:	49152:sv1NllrPx08Gs09WfHEiS6bynd0zskze/lvjz7K0YHVyTbQVhU5JkJUdj02bUMKS:ILlzlfHE9OzskzkY1yTbQVhU5JkJlVzy
MD5:	BC891D2C13ED24F80559B082950C8148
SHA1:	843F46599D19F1253A453C2CAC22185BB51C5A1A
SHA-256:	439D6569EBBF5A109394B2BE05327295E6D86EEDB18640CC8D5BA9E8B9C27EAA
SHA-512:	A72CC9247AF6773322D95D4729886F4BAC7648F83756105F651AB003920EE660D5D5694F06E80B375CA4383ED8A4874BE9EE0482AC8C82A949B74025491540D3
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......c.........." ..... "..j......p.........................................@......7+...`A..........................................(.......(.(.....@.t....`?.\|.......v....@../...(.....................H.(.(....B".8.............(.P............................text....."...... "................. ..`.rdata...5...0"..6...$".............@..@.data........p).."...Z).............@....pdata..\|....`?......\|).............@..@.00cfg..(.....@...................@..@.gxfg...0... @..,...,.............@..@.retplne\....P@......X..................tls.........`@......Z.............@....voltbl.8....p@......\................._RDATA........@......^.............@..@.rsrc...t.....@......`.............@..@.reloc.../....@..0...b*.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\icudtl.dat

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	10400608
Entropy (8bit):	6.282481053515802
Encrypted:	false
SSDEEP:	196608:5GzwSv9AAQu1+liXUxCGZHa93Whlw6ZzFSEoI:53KlQusliXUxCGZHa93Whlw6ZzFSEoI
MD5:	112B22CB7BEEC2B39DC0AD32FCE6E28C
SHA1:	7F1E3D30E01A8A0C2EDD805F6A455FB2412772B4
SHA-256:	973CE575C7E1E9822CAAEAB90687CA655C4AED36CDF9579D2A1D4AD12259DB25
SHA-512:	6B2A9CF628FE8F41456E96D13540C3AB0BD3CB69E88634C05808293FA46CDE6CC637172AD3A36A1D2A31900DED7DCEE014E04E8D78B2F02655A4331668D1E85A
Malicious:	false
Preview:	...'........CmnD........ Copyright (C) 2016 and later: Unicode, Inc. and others. License & terms of use: http://www.unicode.org/copyright.html .?....A..0....B..p ...B...!..2B..`!..BB...!..UB..."..eB...J..xB.. K...B...K...B..P....B.......B.......B......B..P....B.......C..`....C......1C.. ...DC.....WC..0...jC..p...}C.. ....C.......C.......C.......C.......C..@....C.......D......D..@...(D.. ...;D......ND.....aD..P...tD.......D......D.......D.......D..P....D.......D......D..`....E......"E.....7E..0...OE......_E.....rE.. ....E..p....E.......E.. ....E..p....E.......E..@=...E...=...F...=...F..0>..F...>..KF..p ..dF...U...F....&..F..0.&..F....&..F....&..F....&..F....'..G..@.'.$G....'.;G.. .'.ZG..@}(.wG...H)..G..P.)..G..`...G...n..G......H...0+.+H...8+.IH...9+.bH..0<+.yH...=+..H..p.+..H..p.+..H..0.-..H.......H.......I......(I..0...;I......PI.. A..hI..pA..}I...A...I...B...I...m...I...m...I..0n...I...n...I...n...J..0o...J...o..*J...q..@J.....UJ.....jJ......J..P./..J..../..J..../..J..

C:\Users\user\AppData\Local\Microsoft\Teams\current\libEGL.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	501376
Entropy (8bit):	6.465662564698077
Encrypted:	false
SSDEEP:	6144:AKEcTs/jvtGCIvT/BIy/71C6h7i6DPgwlXwuxkC8wmNj8hLeC8K:AKEcTs/jvtGCIb/BI/CLPzxk7wmNj09
MD5:	7ADD324BE081FE150224B05DF7295549
SHA1:	4FBCC70E850CF6D9D38ABED8BB9B0BD1930017EB
SHA-256:	082919B8A7FA6765B8BEEF7A1F5B5318BC3A73AF49A608806B311D1021858F49
SHA-512:	912F4D4E3B3015A6D66733A55B19A83B231DF636F6661DB4432AD722F8BDA34066FC896E2B027C347971145C82EE77319E3562D22CFC227878EB69101FF37CD4
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......c.........." ................P.....................................................`A........................................`.......*...(...............H?...0...v...... ...D...........................(...P!..8...........X................................text............................... ..`.rdata...z... ...\|..................@..@.data....K....... ..................@....pdata..H?.......@..................@..@.00cfg..(....0......................@..@.gxfg....#...@...$..................@..@.retplne\....p...........................tls....!...........................@....voltbl.8..............................._RDATA..............................@..@.rsrc...............................@..@.reloc.. ............"..............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\libGLESv2.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7218864
Entropy (8bit):	6.420865391039325
Encrypted:	false
SSDEEP:	49152:1gXDS35znNYjRDqf7QPJdN/74+nyLLM4csTGbPTMb55eg+FYXz2mKZOLKDtiOK1Z:nWWQPPNdVS3UYMi10vMugPVm8
MD5:	72698B6D5DA719CA9A174FD6559F6E1D
SHA1:	C7B4CD50E569A7260D529C4A815D59EAE38FB961
SHA-256:	296F221E683EF4025E8C8897C248BA671408BC89087E43D0DE04A54C975F491E
SHA-512:	1C44B471AA55DECD8F7C8C74EE361DD406B3E136C2D7E9B2B1EA67E3DC90C627BE51E8782FA4DEFF9144BA83FBE64CA939E878DE839DBEA88F68E504CAE35054
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......c.........." .....8S..p.......+H.......................................n.......n...`A..........................................d.......e.d.....m.p.....k.$.....m..v....m.....,gd......................ed.(....QS.8.............e.......d.@....................text....6S......8S................. ..`.rdata..l!...PS.."...<S.............@..@.data........f......^f.............@....pdata..$.....k......jj.............@..@.00cfg..(....0m.......l.............@..@.gxfg...P*...@m..,....l.............@..@.retplne\....pm.......l..................tls....1.....m.......l.............@....voltbl.F.....m.......l................._RDATA........m.......l.............@..@.rsrc...p.....m.......l.............@..@.reloc........m.......l.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\af.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	128116
Entropy (8bit):	5.370735995351501
Encrypted:	false
SSDEEP:	3072:Q4R1VbSVwDwaPwT6HUrLOd+QeeSsL0J6tuBMWoXO3I9GLfXEAbZt1ScE:rR19SVwDwa3qLOds80KO3q
MD5:	46F982CCD1B8A98DE5F4F9F1E8F19FE5
SHA1:	13165653F2336037D4FB42A05A90251D2A4BC5CF
SHA-256:	9E0AEB9D58FECC27D43E39C8C433C444B2CE773CC5D510FC676E0EBBCAB4BDDF
SHA-512:	2C40E344194DF1CA2D2E88DBA0CB6C7EF308DD9C83E10BBC45286B5E3BC1D98A424A60EC28B2700606916105968984809321505765078D7CADDBB1C4D3F519DE
Malicious:	false
Preview:	........`.).j..H..k..I..l..I..n..I..o..I..p.I..r.0I..s.AI..t.JI..v._I..w.lI..y.rI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J..../J....:J....MJ....OJ....SJ....ZJ....fJ....vJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K....@K....QK...ZK..+.]K..,.{K../..K..0..K..1..K..2..K..3..K..4..K..5..L..6.RL..7.cL..>.xL..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].L...].M...].M...].M...].M...].M...].M...].N...])N...].N...].O...].O...].O...^(O...^3O...^VO...^.O...^.P...^EP...^LP...^{P...^.P...^.P...^.P...^.P...^.P...^.P...^)Q...^9Q...^qQ...^.Q...^.Q...^.Q...^.Q..'^.Q..(^.Q..)^.Q..+^"R..,^AR..-^QR...^_R../^eR..0^}R..1^.R..2^.S..3^kS..4^.S..5^.S..6^.T..7^.T..:^(T..;^.T..<^ZU..=^iU..>^~U..@^.U..A^.V..B^wV..C^.V..D^.V..E^.V..F^.W..G^)X..H^.X..I^.X..K^.Y..M^.Y..N^$Y..O^,Y..P^:Y..Q^YY..V^.Y..W^.Y..X^.Z..Y^4Z..Z^GZ..[^lZ..\^.Z..]^.[..^^k[..c^.[..d^.[..e^.[..f^.[..g^.[..h^.[..i^.[..j^.[..k^.[..l^.[..m^.[

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\am.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	207215
Entropy (8bit):	4.921481662991676
Encrypted:	false
SSDEEP:	3072:R66FO7S/E92t7Rq4rgEkDvuh7gb8oeyHXkiqiwGMqyZJjhEb2WAATMb0kew97MaH:fXgJ1mudHQP+x30jH8+D
MD5:	15B05881E1927EDA0E41B86698CE12DA
SHA1:	D629F23B8A11700B410D25F3DC439C8C353B0953
SHA-256:	4C0129E1023E6E6CB5B71FADD59026D326FEC3393463530C2F30FFF8AACAAEDD
SHA-512:	6F921563D6887D0B712966BF3F8DEA044D1115DD0A5D46EEEE5595966DD88E49D5DFBEC74EE1DE19A330BC9F1A11EF3C7C93D6C5E69F1EE7D1D86085B7A2BD7F
Malicious:	false
Preview:	........@.I.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..I..t..I..v..I..w.,I..y.2I..z.AI..\|.GI..}.YI....aI....fI....nI....vI....~I.....I.....I.....I.....I.....I.....I.....I.....I...."J....J....IJ....KJ....OJ....[J....kJ.....J.....J.....J.....K....+K....2K....5K....6K....BK....KK....gK....mK....tK.....K.....K.....K.....K.....L...%L..+.(L..,.FL../.WL..0.qL..1..L..2..L..3..L..4.)M..5.eM..6..M..7..M..>.(N..?.2N..N.RN..g._N..i.bN..j.fN..k.kN..l.sN...]xN...].N...].N...].O...].O...].P...]AP...]jP...].P...].P...].R...].R...].R...].R...^.R...^.R...^.S...^qS...^JT...^.T...^.T...^.T...^.T...^7U...^@U...^YU...^.U...^.U...^.V...^.V...^}V...^.V...^.V...^.V...^.W..'^(W..(^?W..)^XW..+^.W..,^.X..-^.X...^<X../^NX..0^zX..1^.X..2^.Y..4^BZ..5^\Z..6^.Z..7^.Z..:^.Z..;^.[..<^.\..=^.\..>^.]..@^}]..A^;^..B^-_..C^D_..D^^_..E^._..F^.a..G^.b..H^.c..I^(d..K^^d..M^gd..N^.d..O^.d..P^.d..Q^.d..V^.e..W^.e..X^\|f..Y^.f..Z^.f..[^.g..\^.g..]^.g..^^mh..c^.h..e^.h..f^.h..g^.h..h^.h..i^.i..j^Si..k^Ti..l^ji..m^mi..p^.i..q^.i

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ar.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	212084
Entropy (8bit):	4.998534880105499
Encrypted:	false
SSDEEP:	3072:fYFTGltHPcNRXqhmBdJcFxu3PzGF+hFGAaduzBfMCS2xHMuZtE9P6NsJ0NJOKK1E:fwGleNRx3PzNfPMgSENmW95I1LCA0
MD5:	EFE9ECB3AB373B419A77A5FFED737900
SHA1:	4B8BE68789DA5689CA0AC6306EBCB3CC497463E0
SHA-256:	CC46883F75D337B5074435AD45AB6FDFB1F47875754779CD181D4BB29F91ACBB
SHA-512:	442DAE71B9D002EFD91D4186B96AFCCCFF47C6E8F952EF5AA54D9A5A1846D6235312A4E0F04CBE13719EFC40EE9495EEE0E6D6C56276DE12B1D7FCC83DF219DF
Malicious:	false
Preview:	........9.P.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..H..t..H..v..I..w..I..y.$I..z.3I..\|.9I..}.KI....SI....XI....`I....hI....pI....wI....~I.....I.....I.....I.....I.....I....4J....>J....pJ....sJ....wJ.....J.....J.....J.....J.....J.....K....'K.....K....1K....;K....EK....SK....]K....dK....zK.....K.....K.....K.....K..*..L..+..L..,.)L../.@L..0.KL..1..L..2..L..3..L..4..L..5..M..6.nM..7..M..>..M..?..M..N..M..g..M..i..M..j..M..k..N..l..N...].N...]UN...].N...].O...].O...].O...].P...]#P...]sP...].P...].T...].T...].T...].T...^.T...^.T...^.U...^hU...^AV...^.V...^.V...^.V...^.V...^.W...^.W...^AW...^\W...^qW...^.W...^.W...^GX...^.X...^.X...^.X...^.X..'^.X..(^.X..)^.Y..+^wY..,^.Y..-^.Y../^.Y..0^.Z..1^5Z..2^.Z..3^.[..4^=\..5^[\..6^.\..7^.\..:^.\..;^.]..<^.^..=^.^..>^.^..@^.^..A^._..B^.a..C^Ja..D^oa..E^.a..F^.e..G^.g..H^2i..I^.i..K^.i..M^.i..N^.j..O^.j..P^+j..Q^.j..V^1k..W^tk..X^.k..Y^4l..Z^Rl..[^.l..\^Om..]^.m..^^Jn..c^.n..d^.n..e^.n..f^.n..g^.n..h^.n..i^.o..j^1o..k^2o..l^Ko..m^{o..p^.o..q^.p..r^>p

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\bg.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	231941
Entropy (8bit):	4.718503600082365
Encrypted:	false
SSDEEP:	6144:ZRQoKRDBa4V175RTKa40IzN/frZzrmLy8APWx6y2Hw2ReusUVT:ZCoKRNa4V175RTKn0IzN/fILy8APWx6P
MD5:	470DDE3136A8DA5752FCDE269D4B6B43
SHA1:	85196012CC0DF090650244F7B55E51728C68806B
SHA-256:	CD6701F8B682B6D677AE2010ABFB4BFD19555BB42847E2FFDDC54E203D50B373
SHA-512:	B39397C8A3A081E61DD52EBBC0A4CC2AC33F9427C1EA9215995CD8915D705F30D2D3290742155890A61FC3819B6076C1AE41D278171517622AD35FC6F430702A
Malicious:	false
Preview:	........`.).j..H..k..I..l..I..n..I..o..I..p.I..r.0I..s.AI..t.JI..v._I..w.lI..y.rI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I....!J....CJ....\J....yJ.....J.....J.....J.....J.....J.....J.....J.....K....FK....uK.....K.....K.....K.....K.....K.....K.....K.....L.....L....=L....GL....SL.....L.....L....L..+..L..,..M../.lM..0.uM..1..M..2..M..3..N..4.ZN..5..N..6..O..7.*O..>.]O..?.lO..N..O..g..O..i..O..j..O..k..O..l..O...].O...].P...]GP...]dQ...]zQ...].Q...].Q...].R...]tR...].R...].T...]CT...]QT...]]T...^.T...^.T...^.T...^<U...^.V...^.V...^.V...^8W...^`W...^.W...^.W...^.W...^.X...^xX...^.X...^+Y...^\Y...^.Y...^.Y...^.Y..'^.Y..(^.Y..)^!Z..+^.Z..,^.Z..-^.[...^3[../^?[..0^z[..1^.[..2^.\..3^^]..4^ ^..5^P^..6^.^..7^.^..:^.^..;^._..<^.a..=^.a..>^?a..@^.a..A^.b..B^9c..C^Fc..D^]c..E^.c..F^Xe..G^.f..H^.f..I^?g..K^zg..M^.g..N^.g..O^.g..P^.g..Q^6h..V^.h..W^+i..X^.i..Y^ j..Z^Cj..[^.j..\^[k..]^.k..^^zl..c^.l..e^.l..f^.l..g^.m..h^3m..i^^m..j^.m..k^.m..l^.m..m^.m..p^.n..q^jn

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\bn.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	298415
Entropy (8bit):	4.346199157910122
Encrypted:	false
SSDEEP:	1536:NCTKVimMPg4UlfO0frp9KJ3bVr98JMgE2fpwuDuI9KZ3IlzmhG1A+qSvuA3Szc:NQKfZlfOGy3bVW
MD5:	45915ADB8375DED57D750A4583AC1F17
SHA1:	35DB2151C0D9AD9D2F8AC756D184C8678CC9AD1C
SHA-256:	4E6CA9109FF0EF9DAAAC531EC2D9B84EA7B79CFCFABE79A28F3CD59F4D416320
SHA-512:	BF52B9231E215709C7D31168823936E2BB525D647252A4E8FEC885A7B5FA4E5A065A7BCA14A0DCD4342422D43F296E5A3385C6CECE570AF84C7F952C5D0ED5A9
Malicious:	false
Preview:	........D.E.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..I..t..I..v.(I..w.5I..y.;I..z.JI..\|.PI..}.bI....jI....oI....wI.....I.....I.....I.....I.....I.....I.....I.....I....8J....]J.....J.....J.....J.....J.....J.....J.....K....JK....cK.....K.....K.....K.....L.....L.....L...."L....5L....`L....lL.....L.....L.....L.....L....OM....}M....M..,..M../..M..0..M..1.cN..2..N..3..N..4..N..5.MO..6..O..7..P..>.dP..?.wP..N..P..g..P..i..P..j..P..k..P..l..P...].P...]Q...]nQ...].S...]0S...].S...].S...].T...].T...].T...]nW...].W...].W...].W...^.X...^.X...^wX...^.X...^.Z...^SZ...^eZ...^.Z...^.Z...^.[...^#[...^e[...^.[...^.[...^1\...^z\...^.]...^.]...^.]...^.]...^.]..'^.^..(^8^..)^^^..+^._..,^]_..-^._...^._../^._..0^+`..1^.`..2^.a..3^.b..4^.c..5^.d..6^ud..7^.d..:^.d..;^Hf..<^Rh..=^ih..>^.h..@^.i..A^qj..B^.k..C^.k..D^.k..E^+l..F^.o..G^;q..H^.r..I^3s..K^.s..M^.s..N^.s..O^.s..P^.s..Q^\t..V^xu..W^.u..X^.v..Y^.v..Z^8w..[^`w..\^=x..]^.x..^^.y..c^.z..d^*z..e^Fz..f^Oz..g^Xz..h^.z..i^.z..j^4{..k^5{..l^a{..m^d{..p^.{

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ca.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	143719
Entropy (8bit):	5.392693955944506
Encrypted:	false
SSDEEP:	3072:Yr0tAaCcg4H65rKoMVhoVFBL8lmoT69Q1H7O/RjbNO5ufzwXi3Sk75CU/XlHPFtw:sZcgNoF0O5hXi3Sk75CU/XdFtXfnys6Z
MD5:	B803C8B667CC2F8006CE307019ACA92F
SHA1:	C8D98A7C3CC752176F5A58BA18FCA8FDB8E23810
SHA-256:	6B19FE2F1DD35DB54C46FD8324E037D28D870EEFE6A8E46E608FE403ED78E50A
SHA-512:	43B8101E56F1D08B48336A4C0F7C968BE7F4F65ECF9B7784AFA5920F3FECE501F5EC8DCF4469CBE36D4111EEEB837025F95E9B2C4D096AA43891852D82D2F0BF
Malicious:	false
Preview:	........c.&.j..H..k..I..l..I..n..I..o.#I..p.0I..r.6I..s.GI..t.PI..v.eI..w.rI..y.xI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....7J....WJ....mJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K....!K....K....2K....7K....=K....OK....UK....]K.....K.....K....K..+..K..,..K../..K..0..L..1.:L..2.JL..3.ZL..4.yL..5..L..6..L..7..L..>..L..?..M..N..M..g."M..i.%M..j.)M..k..M..l.4M...]7M...]dM...].M...].N...]%N...]VN...]qN...].N...].N...].N...].O...].O...].O...].O...^.O...^.O...^.P...^@P...^.P...^.Q...^.Q...^<Q...^QQ...^wQ...^.Q...^.Q...^.Q...^.Q...^.Q...^.R...^NR...^\|R...^.R...^.R...^.R..'^.R..(^.R..)^.R..+^#S..,^MS..-^bS...^wS../^zS..0^.S..1^.S..2^:T..3^.T..4^2U..5^OU..6^yU..7^.U..:^.U..;^;V..<^.W..=^.W..>^<W..@^pW..A^.W..B^VX..C^gX..D^sX..E^.X..F^.Y..G^4Z..H^.Z..I^.Z..K^-[..M^7[..N^J[..O^U[..P^i[..Q^.[..V^.[..W^.\..X^l\..Y^.\..Z^.\..[^.\..\^B]..]^.]..^^.]..c^.^..d^%^..e^-^..f^0^..g^3^..h^S^..i^q^..j^.^..k^.^..l^.^..m^.^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\cs.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	146785
Entropy (8bit):	5.805008241395064
Encrypted:	false
SSDEEP:	3072:7YpZ+KPzo3zO1J+17fbYR12ly9g+5X/F/0L8QGF1:M/+PzOvL2ly1F/O8QC
MD5:	DF23ADDC3559428776232B1769BF505E
SHA1:	04C45A59B1C7DCE4CFABBAC1982A0C701F93EED0
SHA-256:	C06AC5459D735F7AC7ED352D9F100C17749FA2A277AF69C25E7AFE0B6954D3C0
SHA-512:	FCECA397DFC8A3A696A1BA302214AB4C9BE910E0D94C5F8824B712EC08FF9491C994F0E6CFA9E8F5516D98C2C539FA141571640B490C8DD28B3A334B0449BDD8
Malicious:	false
Preview:	........R.7.j..H..k..H..l..H..n..H..o..I..p..I..r..I..s.%I..t..I..v.CI..w.PI..y.VI..z.eI..\|.kI..}.}I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....'J....FJ....[J....]J....aJ....nJ....yJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K....TK....qK..*.{K..+.~K..,..K../..K..0..K..1..K..2..L..3..L..4.7L..5.XL..6..L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...]'M...]@M...].M...].M...].N...].N...]2N...]lN...]zN...]LP...]`P...]gP...]mP...^.P...^.P...^.P...^.P...^NQ...^nQ...^tQ...^.Q...^.Q...^.Q...^.Q...^.Q...^.R...^-R...^[R...^oR...^.R...^.R...^.R...^.R...^.S..'^.S..(^.S..)^'S..+^rS..,^.S..-^.S../^.S..0^.S..1^.S..2^ST..3^.T..4^#U..5^9U..6^gU..7^vU..:^.U..;^.V..<^.V..=^.V..>^.V..@^/W..A^.W..B^XX..C^jX..D^}X..E^.X..F^.Z..G^.[..H^X\..I^.\..K^.\..M^.\..N^.\..O^.\..P^.\..Q^.]..V^\]..W^z]..X^.]..Y^.^..Z^.^..[^L^..\^.^..]^.^..^^._..c^Y_..d^a_..e^i_..f^p_..g^s_..h^._..i^._..j^._..k^._..l^._..m^._..p^._

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\da.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	133749
Entropy (8bit):	5.421723634331069
Encrypted:	false
SSDEEP:	3072:qYeFbj8CjaMRZ2zOnX+5MTkdRWwIGYZJx:qYeSNMRkzOnX+WWRWw2
MD5:	875C8EAA5F2A5DA2D36783024BFF40C7
SHA1:	D0CBA9CFBB669BBB8117EEE8ECCF654D37C3D099
SHA-256:	6EE55E456D12246A4EA677C30BE952ADFB3AB57ACA428516E35056E41E7828B5
SHA-512:	6E17692F6064DF4089096AA2726EB609422B077E0FEB01BAAA53C2938D3526256C28FB79EF112164727202CDD902AAE288E35CF894C5EF25FECD7A6EFA51A7E5
Malicious:	false
Preview:	........a.(.j..H..k..I..l..I..n..I..o..I..p.,I..r.2I..s.CI..t.LI..v.aI..w.nI..y.tI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J....2J....;J....TJ....VJ....ZJ....aJ....hJ....yJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J....,K....?K..*.IK..+.LK..,.jK../.zK..0..K..1..K..2..K..3..K..4..K..5..K..6.,L..7.=L..>.PL..?.YL..N.gL..g.rL..i.uL..j.yL..k.~L..l..L...].L...].L...].L...].M...].M...].M...].M...].M...].N...].N...]`O...]\|O...].O...].O...^.O...^.O...^.O...^.O...^.P...^.P...^.P...^.P...^.P...^.Q...^.Q...^-Q...^<Q...^HQ...^.Q...^.Q...^.Q...^.R...^.R...^.R...^,R..'^/R..(^CR..)^KR..+^.R..,^.R..-^.R...^.R../^.R..0^.R..1^.S..2^oS..3^.S..4^;T..5^MT..6^oT..7^\|T..:^.T..;^.U..<^.U..=^.U..>^.U..@^.U..A^LV..B^.V..C^.V..D^.V..E^.W..F^)X..G^.X..H^?Y..I^zY..K^.Y..M^.Y..N^.Y..O^.Y..P^.Y..Q^.Y..V^/Z..W^UZ..X^.Z..Y^.Z..Z^.Z..[^"[..\^u[..]^.[..^^.\..c^0\..e^8\..f^>\..g^A\..h^S\..i^i\..j^{\..k^\|\..l^.\..m^.\..p^.\

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\de.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	143233
Entropy (8bit):	5.481903939044728
Encrypted:	false
SSDEEP:	3072:eMTzAYItWj63Yp8tKgA2dN5N4hlOgxjT+:nnATtKuB4ygVS
MD5:	5E7EA3AB0717B7FC84EF76915C3BFB21
SHA1:	549CB0F459F47FC93B2E8C7EB423FD318C4A9982
SHA-256:	6272ED3D0487149874C9400B6F377FEC3C5F0A7675BE19F8610A8A1ACB751403
SHA-512:	976FB09B4A82665FBF439FA55B67E59AEAA993344DF3F0D1926A82FB64D295BBE6FD77BB65E9F2267D98408E01166DD0C55C8EC7263ED74B3855F65DFFC026ED
Malicious:	false
Preview:	..........[.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..H..t..H..v..H..w..I..y..I..z..I..\|.#I..}.5I....=I....BI....JI....RI....ZI....aI....hI....oI....pI....qI.....I.....I.....I.....I.....I.....I.....J.....J.....J....!J....6J....LJ....`J....yJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J....K....@K...IK..+.LK..,.jK../.{K..0..K..1..K..2..K..3..K..4..K..5..L..6.NL..7.bL..>.vL..?.~L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].L...].M...].M...].M...].M...].N...]#N...]aN...]xN...]qO...].O...].O...].O...^.O...^.O...^.O...^.P...^.P...^.P...^.P...^.Q...^.Q...^3Q...^9Q...^OQ...^jQ...^~Q...^.Q...^.Q...^.R...^BR...^PR...^^R...^nR..'^wR..(^.R..)^.R..+^.R..,^.S..-^.S...^'S../^-S..0^PS..1^.S..2^.S..3^.T..4^7U..5^NU..6^xU..7^.U..:^.U..;^6V..<^.W..=^.W..>^/W..@^WW..A^.W..B^=X..C^DX..D^OX..E^pX..F^.Y..G^.Z..H^.Z..I^.Z..K^.[..M^.[..N^#[..O^,[..P^;[..Q^n[..V^.[..W^.[..X^c\..Y^w\..Z^.\..[^.\..\^.]..]^i]..^^.]..c^.]..e^.]..f^.^..g^.^..h^.^..i^:^..j^S^..k^T^..l^g^..m^j^..p^.^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\el.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	255315
Entropy (8bit):	4.798432799453044
Encrypted:	false
SSDEEP:	6144:ALKSCi5b9F/kDuKxYxbt5I6ROl3+pSb3//zFMeF+fx2hlA66rOw5YlXSWzG:VSCi5b9F/kDuKxYxbt5I6ROl3+pSb3/k
MD5:	7DCA85C1719F09EC9B823D3DD33F855E
SHA1:	4812CB8D5D5081FCC79DBDE686964D364BC1627E
SHA-256:	82B3FBBDC73F76EAEA8595F8587651E12A5F5F73F27BADBC7283AF9B7072818C
SHA-512:	8CB43C80654120C59DA83EFB5B939F762DF4D55F4E33A407D1BE08E885F3A19527ED0078AB512077604EB73C9C744C86EC1A3373B95D7598BF3835AD9F929D67
Malicious:	false
Preview:	........Z./.j..H..k..H..l..I..n..I..o..I..p..I..r.$I..s.5I..t.>I..v.SI..w.`I..y.fI..z.uI..\|.{I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I....J....QJ....vJ.....J.....J.....J.....J.....J.....K.... K....CK....fK.....K.....K.....K.....K.....K.....K.....L....$L....6L....FL....YL....qL....yL.....L.....M....AM...VM..+.YM..,.wM../..M..0..M..1.dN..2..N..3..N..4..N..5.2O..6..O..7..O..>..P..?.!P..N.BP..g.VP..i.YP..j.]P..k.bP..l.lP...]qP...].P...].Q...]7R...]MR...].R...].R...].R...]dS...].S...]*U...]dU...]tU...]zU...^.U...^.U...^.U...^<V...^.W...^.W...^.W...^[X...^.X...^.X...^.X...^.X...^4Y...^HY...^.Y...^.Y...^.Z...^.Z...^.Z...^.Z...^.[..'^,[..(^N[..)^o[..+^.\..,^U\..-^{\...^.\../^.\..0^.\..1^m]..2^`^..3^,_..4^$`..5^J`..6^.`..7^.`..:^.a..;^.b..<^.c..=^.c..>^.c..@^;d..A^6e..B^.e..C^.e..D^ f..E^ef..F^Zh..G^7i..H^<j..I^.j..K^.j..M^.k..N^&k..O^7k..P^Vk..Q^.k..V^ l..W^.l..X^jm..Y^.m..Z^.m..[^\n..\^ o..]^.o..^^.p..c^.p..d^.p..e^.q..f^.q..g^.q..h^:q..i^iq..j^.q..k^.q..l^.q..m^.q

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\en-GB.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	117954
Entropy (8bit):	5.460279502296883
Encrypted:	false
SSDEEP:	3072:O9ch9d5mCOmjQK6rFfBNgizJdLIeqij3ggl+1j:kchT5mCer5Vc
MD5:	DB946E28E8CD67FC45A317A2D22943D3
SHA1:	0E096F66915F75D06F2EC20EAE20F78AD6B235E7
SHA-256:	7EB6AF7620593BDD33CF4A6238E03AFBF179097173CBFFFDADA5B3E25B8F0BBE
SHA-512:	B893650000F463C1F3807F1FEAE3E51664E42EC10C1A5AF7C08970163D5188F1F9FFCC5E82FE2209C78D8B4FC2FEBA050ABEC4C44D1EB122CD42FCC14A8B1C3F
Malicious:	false
Preview:	........m...j..I..k..I..l.I..n.2I..o.7I..p.DI..r.JI..s.[I..t.dI..v.yI..w..I..y..I..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J....$J....3J....CJ....MJ....^J....`J....dJ....hJ....oJ....yJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K....-K....?K...GK..+.JK..,.hK../.yK..0..K..1..K..2..K..3..K..4..K..5..K..6.'L..7.7L..>.LL..?.TL..N.cL..g.lL..i.oL..j.sL..k.xL..l..L...].L...].L...].L...].M...].M...]9M...]GM...]VM...].M...].M...]?N...]QN...]VN...]\N...^eN...^mN...^.N...^.N...^.N...^.O...^.O...^4O...^<O...^RO...^ZO...^mO...^.O...^.O...^.O...^.O...^.P...^?P...^LP...^VP...^eP..'^iP..(^sP..)^\|P..+^.P..,^.P..-^.P...^.P../^.P..0^.Q..1^/Q..2^.Q..3^.Q..4^4R..5^CR..6^hR..7^tR..:^.R..;^.S..<^.S..=^.S..>^.S..@^.S..A^ZT..B^.T..C^.T..D^.T..E^.T..F^.U..G^VV..H^.V..I^.V..K^.W..M^.W..N^'W..O^.W..P^9W..Q^UW..V^.W..W^.W..X^.X..Y^.X..Z^/X..[^SX..\^.X..]^.X..^^.Y..c^RY..d^YY..e^_Y..f^dY..g^hY..h^zY..i^.Y..j^.Y..k^.Y..l^.Y..m^.Y

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\en-US.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	118513
Entropy (8bit):	5.4633121954676085
Encrypted:	false
SSDEEP:	3072:M/WTHfDS2harrWBNgmHJztK3IF3ggl+Scwh:M/WTHmrRYQwh
MD5:	F982582F05EA5ADF95D9258AA99C2AA5
SHA1:	2F3168B09D812C6B9B6DEFC54390B7A833009ABF
SHA-256:	4221CF9BAE4EBEA0EDC1B0872C24EC708492D4FE13F051D1F806A77FE84CA94D
SHA-512:	75636F4D6AA1BCF0A573A061A55077106FBDE059E293D095557CDDFE73522AA5F55FE55A48158BF2CFC74E9EDB74CAE776369A8AC9123DC6F1F6AFA805D0CC78
Malicious:	false
Preview:	........{...j.,I..k.;I..l.FI..n.NI..o.SI..p.`I..r.fI..s.wI..t..I..v..I..w..I..y..I..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....J.....J.....J.....J....3J....@J....OJ...._J....iJ....zJ....\|J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K.....K....!K....IK....[K..*.cK..+.fK..,..K../..K..0..K..1..K..2..K..3..K..4..K..5..L..6.BL..7.RL..>.gL..?.oL..N.~L..g..L..i..L..j..L..k..L..l..L...].L...].L...].L...]1M...]6M...]TM...]bM...]qM...].M...].M...]jN...]\|N...].N...].N...^.N...^.N...^.N...^.N...^%O...^?O...^EO...^_O...^gO...^}O...^.O...^.O...^.O...^.O...^.O...^.P...^GP...^jP...^wP...^.P...^.P..'^.P..(^.P..)^.P..+^.P..,^.Q..-^.Q...^ Q../^$Q..0^3Q..1^UQ..2^.Q..3^.Q..4^VR..5^eR..6^.R..7^.R..:^.R..;^,S..<^.S..=^.S..>^.S..@^.T..A^zT..B^.T..C^.T..D^.U..E^.U..F^.V..G^.V..H^.W..I^HW..K^kW..M^qW..N^{W..O^.W..P^.W..Q^.W..V^.W..W^.X..X^_X..Y^sX..Z^.X..[^.X..\^.Y..]^DY..^^.Y..c^.Y..d^.Y..e^.Y..f^.Y..g^.Y..h^.Y..i^.Y..j^.Y..k^.Y..l^.Z..m^.Z

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\es-419.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	142662
Entropy (8bit):	5.356368782252411
Encrypted:	false
SSDEEP:	1536:U7S7uRmoLU3vL5jRbQZrphXu6KZydaXGQa7K4OdMBPcHYKCOKfKRHe0JWFsMH5Bi:UioL4FlklhXuapOvMowA
MD5:	D25865C02378B768EF5072ECCD8B3BF0
SHA1:	548DBE6E90ECE914D4B79C88B26285EFC97ED70C
SHA-256:	E49A13BEE7544583D88301349821D21AF779EC2EBFCA39EE6A129897B20DBBD0
SHA-512:	817A5ED547EF5CCA026B1140870754CE25064FCA0A9936B4AC58D3B1E654BB49B3FFA8186750B01640AC7D308BF7DE2EADC0F34B7DF3879C112E517D2FAABC94
Malicious:	false
Preview:	........b.'.j..H..k..I..l..I..n..I..o.!I..p..I..r.4I..s.EI..t.NI..v.cI..w.pI..y.vI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.... J....5J....=J....TJ....VJ....ZJ....bJ....pJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K....!K....)K....bK.....K..*..K..+..K..,..K../..K..0..K..1..L..2.)L..3.8L..4.VL..5.yL..6..L..7..L..>..L..?..L..N..M..g..M..i..M..j..M..k.!M..l.)M...].M...][M...].M...]2N...]:N...]^N...]pN...].N...].N...].N...].O...].O...].O...].O...^.O...^.O...^.P...^?P...^.P...^.Q...^.Q...^=Q...^MQ...^uQ...^~Q...^.Q...^.Q...^.Q...^.Q...^.R...^BR...^xR...^.R...^.R...^.R..'^.R..(^.R..)^.R..+^0S..,^dS..-^tS...^.S../^.S..0^.S..1^.S..2^AT..3^.T..4^OU..5^oU..6^.U..7^.U..:^.U..;^[V..<^%W..=^<W..>^QW..@^.W..A^.X..B^uX..C^}X..D^.X..E^.X..F^.Y..G^.Z..H^.Z..I^.Z..K^.[..M^.[..N^%[..O^0[..P^>[..Q^d[..V^.[..W^.[..X^F\..Y^f\..Z^y\..[^.\..\^.]..]^f]..^^.]..c^.]..d^.]..e^.]..f^.]..g^.^..h^.^..i^0^..j^C^..k^D^..l^V^..m^Y^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\es.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	143886
Entropy (8bit):	5.324878998979869
Encrypted:	false
SSDEEP:	3072:2vDALu5r6amp1i1Qw57tROefc70wix6PZ41Y:2becea2iT7/OefcIwo6PZ0Y
MD5:	B1C6B6B7A04C5FB7747C962E3886B560
SHA1:	70553B72B9C382C0B25FA10FE2C967EFBCFCB125
SHA-256:	E4DB8F397CD85FC5575670B3CACFC0C69E4BF07EF54A210E7AE852D2916F1736
SHA-512:	7FCD9AE80791DE19DF8644424FFDF1FEB299F18A38A5D5BC546E8FD3D20D3CED6F565981C3C03026BC5400FE0806DFA3AF3064E7A70E18061F5D5FE6D6BDE8D5
Malicious:	false
Preview:	........a.(.j..H..k..I..l..I..n..I..o..I..p.,I..r.2I..s.CI..t.LI..v.aI..w.nI..y.tI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....)J....>J....FJ....^J....`J....dJ....lJ....zJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K....%K....+K....3K....gK.....K....K..+..K..,..K../..K..0..K..1..L..2..L..3..L..4.LL..5.kL..6..L..7..L..>..L..?..L..N..L..g..M..i..M..j..M..k..M..l. M...]&M...]PM...]mM...].N...].N...]<N...]NN...]aN...].N...].N...]pO...].O...].O...].O...^.O...^.O...^.O...^.P...^.P...^.P...^.P...^.Q...^(Q...^QQ...^ZQ...^lQ...^.Q...^.Q...^.Q...^.Q...^7R...^hR...^zR...^.R...^.R..'^.R..(^.R..)^.R..+^.S..,^RS..-^bS...^tS../^yS..0^.S..1^.S..2^<T..3^.T..4^+U..5^KU..6^vU..7^.U..:^.U..;^V..<^.V..=^.V..>^.W..@^=W..A^.W..B^.X..C^.X..D^+X..E^PX..F^KY..G^.Y..H^?Z..I^.Z..K^.Z..M^.Z..N^.Z..O^.Z..P^.Z..Q^.[..V^n[..W^.[..X^.\..Y^4\..Z^G\..[^.\..\^.]..]^Z]..^^.]..c^.]..d^.]..e^.^..f^.^..g^.^..h^.^..i^8^..j^N^..k^O^..l^a^..m^d^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\et.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	129625
Entropy (8bit):	5.446374075045337
Encrypted:	false
SSDEEP:	1536:9orT9oP+VdcW9DymW643Rryh1oyg9jiuKMPiuLECxZQZwsPQ0ju:9g+G7cW4mW643Jxj3rxL5ZuPQ0q
MD5:	339133A26A28AE136171145BA38D9075
SHA1:	60C40C6C52EFFB96A3EB85D30FADC4E0A65518A6
SHA-256:	F2F66A74B2606565365319511D3C40B6ACCDDE43A0AF976F8B6AC12E2D92EC9F
SHA-512:	D7DD2A1C51A7144F1FE25336460D62622C2503AA64658063EDCB95F50D97D65D538CE4E8AE986AF25F6F7882F6F6578BFB367C201E22DA2ABDD149C0BB4194C1
Malicious:	false
Preview:	........l...j..I..k..I..l.(I..n.0I..o.5I..p.BI..r.HI..s.YI..t.bI..v.wI..w..I..y..I..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J..../J....AJ....VJ....lJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K...."K....-K....3K....9K....bK....{K..*..K..+..K..,..K../..K..0..K..1..K..2..L..3..L..4.%L..5.EL..6.}L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].M...].M...].M...].M...].N...].N...]3N...]sN...].N...]RO...]gO...]nO...]zO...^.O...^.O...^.O...^.O...^VP...^.P...^.P...^.P...^.P...^.P...^.P...^.P...^.Q...^+Q...^ZQ...^pQ...^.Q...^.Q...^.Q...^.Q...^.Q..'^.R..(^.R..)^%R..+^tR..,^.R..-^.R...^.R../^.R..0^.R..1^.R..2^ZS..3^.S..4^2T..5^DT..6^gT..7^uT..:^.T..;^.U..<^.U..=^.U..>^.U..@^.V..A^\|V..B^.V..C^.V..D^.W..E^,W..F^$X..G^.X..H^.Y..I^8Y..K^RY..M^ZY..N^fY..O^mY..P^.Y..Q^.Y..V^.Y..W^.Z..X^iZ..Y^.Z..Z^.Z..[^.Z..\^'[..]^k[..^^.[..c^.[..e^.[..f^.[..g^.[..h^.[..i^.\..j^.\..k^.\..l^/\..m^2\..p^P\

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\fa.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	203938
Entropy (8bit):	5.104565847658903
Encrypted:	false
SSDEEP:	6144:CiQBXt4Ra3a8oQ6NS9/W2ESEm/ovV2XhmN4o6XBmhdBfOpfVKb8YIO/ECuFgjD8i:C7BXt4Ra3a8oQ6NS9/W2ESEm/ovV2Xha
MD5:	A67BFD62DCF0AB4EDD5DF98A5BB26A72
SHA1:	5DEF04429A9D7B3A2D6CAC61829F803A8AA9EF3B
SHA-256:	890CA9DA16EFC1EFCC97EE406F9EFA6A8D288F19A2192F89204BDC467E2868D3
SHA-512:	3419C6BED5FC96E82F9B1F688609B2D2190003B527D95699E071576C25730934FBED3437FDDE870FC836BDC5E690362CAE1E612B7FF779C22B853BAF3CFCAABF
Malicious:	false
Preview:	........(.a.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..H..t..H..v..H..w..H..y..I..z..I..\|..I..}.)I....1I....6I....>I....FI....NI....UI....\I....cI....eI.....I.....I.....I.....J.....J....>J....AJ....IJ....OJ....bJ....yJ.....J.....J.....J.....J.....J.....J.....K....!K..../K....7K....>K....RK....^K....qK.....K.....K....L..+..L..,.&L../.JL..0.XL..1..L..2..L..3..L..4..L..5.#M..6..M..7..M..>..M..?..M..N..N..g.%N..i.(N..j.,N..k.1N..l.;N...]EN...].N...].N...].O...].O...].P...]2P...]bP...].P...].P...].R...].R...].R...].R...^.S...^$S...^wS...^.S...^.T...^.T...^.T...^HU...^]U...^.U...^.U...^.U...^.U...^.V...^mV...^.V...^ W...^OW...^hW...^yW...^.W..'^.W..(^.W..)^.W..+^DX..,^xX..-^.X...^.X../^.X..0^.X..1^GY..2^3Z..3^.[..4^.[..5^.[..6^A\..7^R\..:^y\..;^d]..<^.^..=^.^..>^.^..@^C_..A^.`..B^.`..C^.`..D^.a..E^Ba..F^.c..G^.d..H^.e..I^.e..M^8f..N^Tf..O^bf..P^yf..Q^.f..V^Dg..W^.g..X^h..Y^Sh..Z^zh..[^.h..\^Di..]^.i..^^:j..c^wj..e^.j..f^.j..g^.j..h^.j..i^.j..j^.j..k^.j..l^.k..m^.k..p^>k..q^}k..r^.k..s^:l

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\fi.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	132519
Entropy (8bit):	5.409933983192656
Encrypted:	false
SSDEEP:	3072:KTDM6BJkRQxRcMfOAZZTUqyUEvU2yjZEE218vWURl/HR2j8bR+UhSjNM1OACX1hl:6ngj+2lE218vWURxcj5NnX1hwef
MD5:	ACEED6757E21991632B063A7FE99C63C
SHA1:	491B4AA5EAEB93E662F720C721736E892B9117E5
SHA-256:	370164E61142D8609D176EC0CC650540C526156009070563F456BCDB104E9C0F
SHA-512:	664C369E74930A61A8C9CCEE37321C6610FFDEBA8E4E8A5D4F9444D530097B0F4556E7B369DFD55323FE7DF70B517C84AE9D62A89C1984A8CF56BAE92D3E0455
Malicious:	false
Preview:	........R.7.j..H..k..H..l..H..n..H..o..I..p..I..r..I..s.%I..t..I..v.CI..w.PI..y.VI..z.eI..\|.kI..}.}I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....)J....BJ....DJ....HJ....MJ....\J....hJ....zJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J...."K....3K..*.;K..+.>K..,.\K../.~K..0..K..1..K..2..K..3..K..4..K..5..L..6.QL..7.pL..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].L...].M...].M...].M...].M...].N...]!N...]SN...]`N...]?O...]VO...]]O...]eO...^vO...^.O...^.O...^.O...^-P...^ZP...^eP...^.P...^.P...^.P...^.P...^.P...^.P...^.P...^!Q...^;Q...^iQ...^.Q...^.Q...^.Q...^.Q..'^.Q..(^.Q..)^.Q..+^(R..,^MR..-^_R...^pR../^vR..0^.R..1^.R..2^(S..3^.S..4^.S..5^.S..6^'T..7^4T..:^XT..;^.T..<^.U..=^.U..>^.U..@^.U..A^ZV..B^.V..C^.V..D^.V..E^.V..F^.W..G^aX..H^.X..I^.Y..K^'Y..M^+Y..N^9Y..O^EY..P^RY..Q^sY..V^.Y..W^.Y..X^2Z..Y^DZ..Z^SZ..[^{Z..\^.Z..]^.[..^^X[..c^z[..e^.[..f^.[..g^.[..h^.[..i^.[..j^.[..k^.[..l^.[..m^.[..p^.[

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\fil.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	148094
Entropy (8bit):	5.159512531813897
Encrypted:	false
SSDEEP:	3072:N4uI0cHX9ooz8MDwGgbKIAaCz66/4pSe5:QRyooMiACB5
MD5:	CB9FB6BC0E1EC2CB3A0C1F9C2DFBC856
SHA1:	C3B5900A38354EA00B63622BB9044FFB4788723B
SHA-256:	945C0160938C3BCECDA6659A411B33CD55DFAC18814BED88575BFD100C53D42E
SHA-512:	6ED77D0FBBB1186CCB7493708F55F8A2C3005A1F1DA759C16289713A853BCAD4A2CC4846874D67F722F461B1950A763508A91A7970BC0EB5DA686206AAA8489B
Malicious:	false
Preview:	........r...j..I..k.)I..l.4I..n.<I..o.AI..p.NI..r.TI..s.eI..t.nI..v..I..w..I..y..I..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.... J....-J....BJ....XJ....eJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K.....K.....K....K..../K....8K....IK....PK....XK.....K.....K....K..+..K..,..K../..L..0..L..1.=L..2.NL..3.VL..4.tL..5..L..6..L..7..L..>..M..?..M..N..M..g.&M..i.)M..j.-M..k.2M..l.@M...]EM...]yM...].M...].N...] N...]LN...]_N...]vN...].N...].N...].P...].P...] P...]&P...^7P...^BP...^^P...^.P...^.Q...^2Q...^;Q...^`Q...^kQ...^.Q...^.Q...^.Q...^.Q...^.Q...^.R...^(R...^SR...^\|R...^.R...^.R...^.R..'^.R..(^.R..)^.R..+^#S..,^ES..-^US...^lS../^tS..0^.S..1^.S..2^.T..3^.T..4^.T..5^.U..6^DU..7^\U..:^zU..;^.V..<^.V..=^.V..>^.V..@^(W..A^.W..B^7X..C^CX..D^WX..E^uX..F^.Y..G^.Z..H^T[..I^.[..K^.[..M^.[..N^.[..O^.[..P^.[..Q^.\..V^a\..W^.\..X^.\..Y^.]..Z^']..[^W]..\^.]..]^.^..^^m^..c^.^..d^.^..e^.^..f^.^..g^.^..h^.^..i^.^..j^.^..k^.^..l^._..m^._

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\fr.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	153314
Entropy (8bit):	5.373911049579379
Encrypted:	false
SSDEEP:	3072:l//px7k5+45t3JTI3LbEKdG2Hr+6VB8RNtrAXLYpSKnRHDEhMaIzKByroFDuFcVR:lzkp5VJTI3LgEG2Hr+6VB8RNtrGLYprI
MD5:	BC286000070C9A918A8E674F19A74E12
SHA1:	41221BB668E41C13FBF5F110E7F2C6D900CDFFD1
SHA-256:	D641D9D73262CA65A613EE0395204435D6830316DD551F8992407AE77EAD4B64
SHA-512:	553DC84FFD09DD969802FC339AB20F6AF3C36442C1EA23E4199519F2C5FB50BE79874AE455CE5FF44511A3ADCEDAE7F3030D13E0ECF2B456233D5F4FF186A5DD
Malicious:	false
Preview:	........U.4.j..H..k..H..l..H..n..I..o..I..p..I..r..I..s.+I..t.4I..v.II..w.VI..y.\I..z.kI..\|.qI..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J....+J....-J....1J....8J....EJ....SJ....jJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K....8K....YK..*.cK..+.fK..,..K../..K..0..K..1..K..2..K..3..L..4.!L..5.AL..6..L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...]&M...]GM...].M...].M...].N...].N...]7N...].N...].N...].O...].O...].O...].O...^.O...^.O...^.P...^VP...^.P...^.Q...^.Q...^=Q...^NQ...^pQ...^yQ...^.Q...^.Q...^.Q...^.R...^/R...^yR...^.R...^.R...^.R...^.R..'^.R..(^.R..)^.S..+^`S..,^.S..-^.S../^.S..0^.S..1^.T..2^.T..3^.U..4^.U..5^.U..6^.U..7^.V..:^#V..;^.V..<^.W..=^.W..>^.W..@^.W..A^}X..B^,Y..C^?Y..D^\Y..E^.Y..F^@[..G^.\..H^.\..I^.]..M^B]..N^U]..O^_]..P^q]..Q^.]..V^.]..W^.^..X^.^..Y^.^..Z^.^..[^.^..\^{_..]^._..^^G`..c^r`..d^{`..e^.`..f^.`..g^.`..h^.`..i^.`..j^.`..k^.`..l^.`..m^.`..p^.a..q^6a

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\gu.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	289453
Entropy (8bit):	4.382772751875843
Encrypted:	false
SSDEEP:	3072:6bnPhzx39v+O0lT1A626EPqP8M388CMrPCK35YdO3C36SoYimPVOyVWqTPgrmd/t:eHVOYFf
MD5:	AF5CC703C77E1A4B27233DEB73C6ACE8
SHA1:	EA92DCE379EC9405FD84274566D363CE302D7F1D
SHA-256:	CD761009ECBD4736B24383F020DA05D2E6B9396C67A7EC1F4AC1966943CF9EAB
SHA-512:	DD379CBAB7A6FDCE05B0FF34D339C2F3320F83F76D8E1FB7EBF20EDCFEBE541AE454490EEB83D8EDC069AAF3DB52D6B7DE6D701672A13E75DFE59840E8F2C5DF
Malicious:	false
Preview:	........@.I.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..I..t..I..v..I..w.,I..y.2I..z.AI..\|.GI..}.YI....aI....fI....nI....vI....~I.....I.....I.....I.....I.....I.....J....1J....VJ.....J.....J.....J.....J.....J.....K....(K....>K....`K.....K.....K.....K.....K.....K.....K.....K.....L....-L....@L....WL....xL.....L.....L.....M....8M...`M..+.cM..,..M../..M..0..M..1.>N..2.UN..3.xN..4..N..5..N..6.>O..7.yO..>..O..?..O..N..P..g.+P..i..P..j.2P..k.7P..l.EP...]JP...].P...].P...].R...]6R...]zR...].R...].S...].S...].S...].V...].V...].V...].V...^.W...^W...^.W...^.W...^.Y...^NY...^jY...^.Y...^.Y...^.Z...^ Z...^FZ...^.Z...^.Z...^j[...^.[...^.\...^x\...^.\...^.\...^.\..'^.\..(^.]..)^<]..+^.]..,^/^..-^W^...^.^../^.^..0^.^..1^2_..2^.`..3^.a..4^!b..5^Ob..6^.b..7^.b..:^.c..;^\d..<^.f..=^7f..>^vf..@^.f..A^)h..B^Li..C^}i..D^.i..E^&j..F^.m..G^Co..H^ip..I^.p..K^Qq..M^aq..N^zq..O^.q..P^.q..Q^.r..V^.r..W^#s..X^*t..Y^Tt..Z^.t..[^.t..\^.u..]^.v..^^Qw..c^.w..d^.w..e^.w..f^.w..g^.w..h^Ax..i^.x..j^.x..k^.x..l^#y..m^&y

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\he.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	178549
Entropy (8bit):	4.72143996697818
Encrypted:	false
SSDEEP:	3072:Yy/mfC+WxgbllqMyX95E1u3XTnw6ImgMxQZ:1/mfCwbllqMyX95E1mXTnw6ImgMxQZ
MD5:	B2F893D17E118CD03055B55B0923206B
SHA1:	99B6358438A3EAFFAE38DCF6A215D8C5F9BFDC26
SHA-256:	F6D1E2A269783F27B85C2DB2CE9286F581EC2E16586ECAC476AB5735CD8AE12F
SHA-512:	34FA1C4BCE2F9E2C5C7B494A829F5B492B40E8F4F0BC586F564755DE703B5765D81795C67E19A27D2F21D297CE3B7E5058A126118AFE6911CC429FC58D67F13E
Malicious:	false
Preview:	........9.P.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..H..t..H..v..I..w..I..y.$I..z.3I..\|.9I..}.KI....SI....XI....`I....hI....pI....wI....~I.....I.....I.....I.....I.....I.....J.... J....,J....IJ....KJ....OJ....fJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K....(K....3K....GK....OK....YK.....K.....K..*..K..+..K..,..K../..L..0..L..1.UL..2.jL..3.}L..4..L..5..L..6..M..7.-M..>.BM..?.SM..N.lM..g.yM..i.\|M..j..M..k..M..l..M...].M...].M...].M...].N...].N...].O...]'O...]AO...].O...].O...]0R...]ER...]OR...]YR...^wR...^.R...^.R...^.R...^.S...^.S...^.T...^PT...^iT...^.T...^.T...^.T...^.T...^.T...^.U...^OU...^.U...^.U...^.U...^.U...^.U..'^.U..(^.V..)^#V..+^.V..,^.V..-^.V...^.V../^.V..0^.W..1^QW..2^.W..3^\|X..4^.Y..5^/Y..6^aY..7^rY..:^.Y..;^HZ..<^7[..=^T[..>^t[..@^.[..A^`\..B^N]..C^`]..D^\|]..E^.]..F^<`..G^fa..H^.b..I^.b..K^.c..M^'c..N^>c..O^Kc..P^`c..Q^.c..V^.c..W^)d..X^.d..Y^.d..Z^.d..[^Be..\^.e..]^.f..^^lf..c^.f..d^.f..e^.f..f^.f..g^.f..h^.f..i^.g..j^.g..k^.g..l^2g..m^5g

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\hi.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	299590
Entropy (8bit):	4.360369510849167
Encrypted:	false
SSDEEP:	3072:HHD12s+/nqzwakcWfKSYh2s3cwEVhYWVLVogBO/S/Ffm9NLahPzRvTHIf+ovahgJ:h2s+bL7y3
MD5:	C6CDD9F54AE4D9EDA4A2EC12BE1DD227
SHA1:	04315C2652D7810EAC876714E2B52F11E089B322
SHA-256:	702938B3450C83F10326FEAAD396A0B85EB93E50F5898837BF2653A4A456C3B1
SHA-512:	FC0CE390A9BA9DC5301B79C284D643C6B7FA93A09AB6D7CD70F5C76E21BF2841AC152567F33F009599416F7C52A0A74A3EF1F830E7596BBC9C9A3BD368E7CFAD
Malicious:	false
Preview:	........5.T.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..H..t..H..v..I..w..I..y..I..z.+I..\|.1I..}.CI....KI....PI....XI....`I....hI....oI....vI....}I....~I.....I.....J....3J....XJ.....J.....J.....J.....J.....J.....J.....K....2K....TK....vK.....K.....K.....K.....K.....K.....K.....L....(L....>L....jL.....L.....L.....L....&M....NM..*.mM..+.pM..,..M../..M..0..M..1.aN..2..N..3..N..4..N..5..O..6.pO..7..O..>..P..?..P..N.RP..g.uP..i.xP..j.\|P..k..P..l..P...].P...]`Q...].Q...].S...].T...]lT...].T...].T...].U...].U...].X...]5Y...]AY...]SY...^.Y...^.Y...^.Z...^.Z...^4\...^.\...^.\...^p]...^.]...^-^...^F^...^.^...^.^...^.^...^._...^.`...^.`...^)a...^Na...^ra...^.a..'^.a..(^.a..)^.a..+^.b..,^.b..-^&c...^[c../^kc..0^.c..1^/d..2^&e..3^.f..4^.g..5^3g..6^rg..7^.g..:^.g..;^.i..<^.j..=^.j..>^.k..@^.k..A^.l..B^.n..C^5n..D^fn..E^.n..F^.q..G^.s..H^Rt..I^.t..K^.u..M^-u..N^Lu..O^^u..P^}u..Q^.v..V^Pw..W^.w..X^.x..Y^.x..Z^.x..[^Cy..\^.z..]^.z..^^.{..c^U\|..e^t\|..f^}\|..g^.\|..h^.\|..i^.}..j^u}..k^v}..l^.}..m^.}..p^.~

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\hr.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	140485
Entropy (8bit):	5.488201715897777
Encrypted:	false
SSDEEP:	3072:Kx0LpBWR8sKsAGCm+VdljWNqcUlEdp94LnMUpEP1yMMoPa7ayvWlx9s:KAyC6qdl
MD5:	209EFAA890532DDBB1673852E42DED7E
SHA1:	8E9A3E643183D4CBDFAD9FD2A116E749B5313A95
SHA-256:	3D01F9D2C51EFA0C0D8D720DD832493B1B87D2429970396C42CEE2199E7BEF40
SHA-512:	5410B31AB46CCFD29B750F39D3796A533EC0C0A7B7B31B70977F59F348DD4190EDC00C86DB8D5B73DF2117F27FD283DE2057493C081CEF69D04AD9894EB5C05B
Malicious:	false
Preview:	........^.+.j..H..k..I..l..I..n..I..o..I..p.&I..r.,I..s.=I..t.FI..v.[I..w.hI..y.nI..z.}I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.... J....4J....EJ....GJ....KJ....SJ...._J....mJ....~J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K....?K....aK..*.lK..+.oK..,..K../..K..0..K..1..K..2..K..3..L..4..L..5.<L..6.~L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].M...]4M...].M...].M...].M...].N...].N...]PN...]`N...].P...].P...].P...]"P...^7P...^?P...^hP...^.P...^$Q...^QQ...^YQ...^.Q...^.Q...^.Q...^.Q...^.Q...^.Q...^.R...^=R...^YR...^.R...^.R...^.R...^.R...^.S..'^.S..(^$S..)^5S..+^}S..,^.S..-^.S...^.S../^.S..0^.S..1^.T..2^.T..3^.T..4^PU..5^dU..6^.U..7^.U..:^.U..;^)V..<^.V..=^.V..>^.W..@^FW..A^.W..B^~X..C^.X..D^.X..E^.X..F^.Z..G^.[..H^}\..I^.\..K^.\..M^.\..N^.\..O^.]..P^.]..Q^5]..V^t]..W^.]..X^.^..Y^.^..Z^1^..[^Y^..\^.^..]^._..^^^_..c^._..e^._..f^._..g^._..h^._..i^._..j^._..k^._..l^._..m^._..p^.`

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\hu.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	152821
Entropy (8bit):	5.620048725381683
Encrypted:	false
SSDEEP:	3072:eLqPnCMNxIRZk/3gIHmnRjiGhoDotUGnCdAtRdpEsLY5M3ICm:+6NWRQ3QZiGLUGnjRdpER63ICm
MD5:	7317ADFCBA87621963E9CB2F44600E2F
SHA1:	0398D795F9A3CDE03AE85E8CD2C4723E7EF5F7E4
SHA-256:	6EDCDAF17483C4B7B74D9C728C3F38D9E4704BFBDB618B578C7CCB6BBE6E824F
SHA-512:	E8EC0DF2DDF67799194E8D3F722B5643553FB05026BD5F8D933D1CC18DF6A641EB1B810E22114B44513B57A005D326B91A1FCF1C470A636CD42C5BC5FA0F254F
Malicious:	false
Preview:	........X.1.j..H..k..H..l..I..n..I..o..I..p..I..r. I..s.1I..t.:I..v.OI..w.\I..y.bI..z.qI..\|.wI..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....J....?J....FJ....ZJ....\J....`J....lJ....sJ.....J.....J.....J.....J.....J.....K.....K.....K.....K.....K.....K....7K....AK....XK....^K....dK.....K.....K....K..+..K..,..K../..K..0..L..1.9L..2.EL..3.RL..4.oL..5..L..6..L..7..L..>..M..?..M..N.%M..g.3M..i.6M..j.:M..k.?M..l.FM...]KM...]\|M...].M...]^N...]lN...].N...].N...].N...].O...]4O...]BP...]RP...]YP...]cP...^uP...^.P...^.P...^.P...^bQ...^.Q...^.Q...^.Q...^.Q...^.Q...^.Q...^.R...^.R...^2R...^sR...^.R...^.R...^.S...^.S...^(S...^:S..'^AS..(^SS..)^cS..+^.S..,^.S..-^.S...^.S../^.S..0^.T..1^/T..2^.T..3^.U..4^.U..5^.U..6^.U..7^.U..:^.V..;^.V..<^bW..=^uW..>^.W..@^.W..A^SX..B^.X..C^.X..D^.X..E^.X..F^.Z..G^.Z..H^.Z..I^G[..K^t[..M^z[..N^.[..O^.[..P^.[..Q^.[..V^2\..W^[\..X^.\..Y^.\..Z^.]..[^D]..\^.]..]^.^..^^}^..c^.^..d^.^..e^.^..f^.^..g^.^..h^.^..i^.^..j^._..k^._..l^%_..m^(_

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\id.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	127592
Entropy (8bit):	5.337449892048412
Encrypted:	false
SSDEEP:	3072:7uYgZU9ZZpzS95KW68e0sSx8WsAzaZts3cCXw:7uYWUxpuvtwSlsEaP
MD5:	E2265E49D69D75B1DD967A05208DC896
SHA1:	FBEE6EFFF6ECDE688C37DA898F8480173F4186F9
SHA-256:	45018EC216D0F59DC4FEF155C6123C697124CA28AA51ADF19C2CCEC421DFF3A5
SHA-512:	78B1B478F82FC8089A890728D2A886B961607F67A0D06F91FD5FCEA68ECE5B03CF58A0BB7AD5ED622602A4911E9019F222673A767B39707D383618A6C4B719AE
Malicious:	false
Preview:	........X.1.j..H..k..H..l..I..n..I..o..I..p..I..r. I..s.1I..t.:I..v.OI..w.\I..y.bI..z.qI..\|.wI..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J..../J....1J....5J....=J....EJ....ZJ....kJ....zJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K....2K..*.=K..+.@K..,.^K../.nK..0.rK..1..K..2..K..3..K..4..K..5..K..6.)L..7.<L..>.PL..?.XL..N.iL..g.rL..i.uL..j.yL..k.~L..l..L...].L...].L...].L...]^M...]eM...].M...].M...].M...].M...].N...].N...].N...].N...^.N...^.O...^.O...^IO...^.O...^.O...^.O...^.P...^#P...^LP...^UP...^hP...^zP...^.P...^.P...^.P...^.Q...^HQ...^UQ...^^Q...^nQ..'^tQ..(^.Q..)^.Q..+^.Q..,^.Q..-^.Q...^.Q../^.R..0^ R..1^RR..2^.R..3^'S..4^.S..5^.S..6^.S..7^.S..:^.S..;^.T..<^?U..=^NU..>^`U..@^.U..A^.U..B^]V..C^mV..D^{V..E^.V..F^wW..G^.W..H^gX..I^.X..K^.X..M^.X..N^.X..O^.X..P^.X..Q^.Y..V^JY..W^uY..X^.Y..Y^.Y..Z^.Y..[^.Z..\^qZ..]^.Z..^^.Z..c^)[..d^3[..e^=[..f^B[..g^G[..h^][..i^u[..j^.[..k^.[..l^.[..m^.[..p^.[

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\it.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	141689
Entropy (8bit):	5.2487922257035375
Encrypted:	false
SSDEEP:	3072:hzB8XN5Sv35T3gUYTEKDoLxt1yN4tA7kxAjidOp7kPMHe80Ru8:7MYv35T3gUYTBcLxDyN4tA7kxAji1E+f
MD5:	2CF96A1E0B554FAF0794206BF140E140
SHA1:	A612D9FC6B006514D52B73911BA4707E4C0A695F
SHA-256:	6FDBD3EC9730D4C101635D9601C5F7902AC76F8804D544E4B07F8DFC2743F292
SHA-512:	213AAB25659985830C5D12CD8319CDD9F441E84292F3E85A6545C6A3F069C602440AC292D4285CBF434B12A6CF66747251197B978774068758BE9E53D636C2B7
Malicious:	false
Preview:	........[...j..H..k..H..l..I..n..I..o..I..p. I..r.&I..s.7I..t.@I..v.UI..w.bI..y.hI..z.wI..\|.}I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....1J....9J....JJ....LJ....PJ....WJ....cJ....yJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K....!K....'K....XK....vK....K..+..K..,..K../..K..0..K..1..L..2..L..3..L..4.>L..5.\L..6..L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..M..l..M...].M...]:M...]WM...].N...].N...]N...]GN...]XN...].N...].N...].O...].O...].O...].O...^.O...^.O...^.P...^TP...^.P...^.Q...^ Q...^=Q...^KQ...^hQ...^pQ...^.Q...^.Q...^.Q...^.Q...^.Q...^KR...^xR...^.R...^.R...^.R..'^.R..(^.R..)^.R..+^.S..,^<S..-^IS...^ZS../^^S..0^zS..1^.S..2^.T..3^sT..4^.T..5^.U..6^7U..7^IU..:^cU..;^.U..<^.V..=^.V..>^.V..@^+W..A^.W..B^.X..C^.X..D^*X..E^[X..F^{Y..G^.Z..H^.Z..I^.Z..M^.Z..N^.[..O^.[..P^"[..Q^G[..V^.[..W^.[..X^)\..Y^O\..Z^`\..[^.\..\^.]..]^Y]..^^.]..c^.]..d^.]..e^.]..f^.]..g^.]..h^.^..i^1^..j^D^..k^E^..l^S^..m^V^..p^x^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ja.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	168609
Entropy (8bit):	5.757161601136051
Encrypted:	false
SSDEEP:	1536:Hu9OLUlhagNjy/d4thSbFsSM8IpB46XeyOsg+Ft+nFUNjyNLAVK:qcUlMItthSbFFM8C+ZiFt+FijyNLAVK
MD5:	781FEC59B38A21DC663F3A482732196B
SHA1:	1B660BA0BD9AAF67C5FE49A372687FACD6D264EA
SHA-256:	3849F8B48B034FE6319112EFF77B7C9F6A8D7B20CF7BC8400528A0A8458677DA
SHA-512:	F2C3A6D8C23F72DB8E70EC8CD87793EB103B58BDD3976E99F42867C33A6688A41C79EADCDF25C6AE01FD20920AFFD43F228A5134AF28F83EE50FE02819665E95
Malicious:	false
Preview:	..........~.j.LH..k.]H..l.fH..m.nH..o..H..p..H..v..H..w..H..y..H..z..H..\|..H..}..H.....H.....H.....H.....H.....H.....I.....I.....I.....I...."I....)I....+I....gI.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J....4J....IJ....uJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J....MK....mK...sK..+.vK..,..K../..K..0..K..1..L..2..L..3.(L..4.IL..5.pL..6..L..7..L..>..L..?..M..N..M..g.'M..i.M..j..M..k.3M..l.;M...]@M...].M...].M...].N...].N...].N...].N...],O...]>O...].P...].P...].P...].P...^.P...^.P...^.Q...^CQ...^.R...^=R...^.R...^.R...^.R...^.R...^.R...^.R...^.S...^iS...^.S...^.S...^.T...^5T...^>T...^MT..'^ST..(^tT..)^.T..+^.T..,^.U..-^8U...^JU../^PU..0^qU..1^.U..2^/V..3^.V..4^/W..5^AW..6^{W..7^.W..:^.W..;^1X..<^.Y..=^.Y..>^7Y..@^.Y..A^.Z..B^.Z..C^.Z..D^.Z..E^.[..F^.[..G^.\..H^.]..I^q]..K^.]..M^.]..N^.]..O^.]..P^.]..Q^.^..V^c^..W^.^..X^._..Y^+_..Z^=_..[^`_..\^._..]^.`..^^\|`..c^.`..e^.`..f^.`..g^.`..h^.`..i^.a..j^.a..k^/a..l^Aa..m^Da..p^za..q^.a..r^.a..s^:b..t^Qb

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\kn.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	327618
Entropy (8bit):	4.292167615217582
Encrypted:	false
SSDEEP:	6144:cSs3wIBtgRlqEgknaw6T+PDu6m1TSX4zzEr7JQO6eJ2:cS8IRldQ+8/Ho2
MD5:	66867A2133EF0C73F385AF7D5D2EED91
SHA1:	8CA6E7E6D679255C2C151D38CF70A5F25CCE059F
SHA-256:	407599A388BC151CCD2561181EA90FF620F4CB5C767317AF8CA4748927BA7F35
SHA-512:	482C0B75C921470866B7C6CCF09CDDD59CE81507E8DF7A2158D3ABF08C7201EBEED67C1ECD36F5CB015A8833AE9F1917AB6118F9F0A959364DE958729295F37C
Malicious:	false
Preview:	........G.B.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..I..t..I..v.-I..w.:I..y.@I..z.OI..\|.UI..}.gI....oI....tI....\|I.....I.....I.....I.....I.....I.....I.....I....5J....lJ.....J.....J.....J....AK....CK....OK....jK.....K.....K.....K...."L...._L.....L.....L.....L.....L.....L.....L.....L.....M....M....TM....cM....~M.....M....4N...XN..+.[N..,.yN../..N..0..N..1.[O..2.uO..3..O..4..O..5./P..6..P..7..P..>..Q..?.AQ..N..Q..g..Q..i..Q..j..Q..k..Q..l..Q...].Q...]4R...].R...]1T...]IT...].T...].T...]/U...]~U...].U...].X...].X...].X...].Y...^DY...^kY...^.Y...^=Z...^.[...^.[...^.\...^.\...^.\...^.\...^.\...^-]...^j]...^.]...^z^...^.^...^._...^._...^'`...^P`...^{`..'^.`..(^.`..)^.`..+^.a..,^.a..-^.b...^^b../^vb..0^.b..1^Ec..2^.d..3^.e..4^.f..5^.f..6^&g..7^Zg..:^.g..;^Ii..<^Zk..=^qk..>^.k..@^Yl..A^.m..B^.n..C^]o..D^.o..E^.o..F^.s..G^qu..H^.v..I^.w..M^.w..N^4x..O^Fx..P^wx..Q^.x..V^.y..W^Gz..X^l{..Y^.{..Z^.{..[^h\|..\^e}..]^E~..^^)...c^....d^....e^....f^....g^....h^....i^....j^...k^...l^....m^....p^w.

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ko.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	141682
Entropy (8bit):	6.102101768419481
Encrypted:	false
SSDEEP:	3072:O7nJcQ4G+othXoAgWCYeHw0pFSCukpHTegNMq7Hh1I/4KiWgx7D7/xRAmxJT6rJk:O7JQGbtkSq7Hh1qydSwx5
MD5:	27705557EB4977C33BC69F27C2EE9F96
SHA1:	B0297538C4E68515B8F65D44371CB8F4CDBC489F
SHA-256:	DE71F906636D2A8F5833A22E92B61161182C53E233B75B302DBE061ED57E9BDC
SHA-512:	53C8917049D72A9739BF7F2ABDBDE3120ED3124967CD9B1B71B172B7B36ED41A1FF970D3841C0F5EB5B53616DD9F8E03F65A79E6A6964B83DA2C84174C1DD56F
Malicious:	false
Preview:	............j.BH..k.OH..l.WH..m._H..o.eH..p.lH..r.rH..s..H..t..H..y..H..z..H..\|..H..}..H.....H.....H.....H.....H.....H.....H.....I.....I.....I.....I....PI....\I....lI.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J....%J.....J....4J....:J....DJ....UJ....[J....dJ.....J.....J....J..+..J..,..J../..K..0..K..1._K..2.pK..3.\|K..4..K..5..K..6..K..7..L..>.&L..?.7L..N.KL..g.UL..i.XL..j.\L..k.aL..l.oL...]tL...].L...].L...]dM...]jM...].M...].M...].M...].M...].N...].N...].O...].O...^$O...^O...^EO...^UO...^.O...^"P...^(P...^XP...^eP...^\|P...^.P...^.P...^.P...^.P...^.Q...^.Q...^kQ...^.Q...^.Q...^.Q...^.Q..'^.Q..(^.Q..)^.Q..+^ER..,^yR..-^.R...^.R../^.R..0^.R..1^.R..2^kS..3^.S..4^cT..5^zT..6^.T..7^.T..:^.T..;^pU..<^kV..=^\|V..>^.V..@^.V..A^GW..B^.W..C^.W..D^.W..E^.W..F^.Y..G^.Y..H^.Z..I^XZ..M^.Z..N^.Z..O^.Z..P^.Z..Q^.Z..V^3[..W^f[..X^.[..Y^.[..Z^.\..[^,\..\^.\..]^.\..^^*]..e^O]..f^R]..g^X]..h^l]..i^.]..j^.]..k^.]..l^.]..m^.]..p^.]..q^.^..r^+^..s^z^..t^.^..u^.^..w^.^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\lt.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	155112
Entropy (8bit):	5.597757057369356
Encrypted:	false
SSDEEP:	3072:DTkdJNFJ1BDyyUa73L6fbX9A8Z2I76S1a5nJ:nkTJ10Pa73efbX9Aw2I76S6
MD5:	A3E29F4A3CA6F2058A6F464E49F914B6
SHA1:	3FC632EACCF91E86B365D444E7ACBA6F9302AA5C
SHA-256:	EC70EDCA70373390F028AA751A74057FB1C2C583C310492723A228C863007C47
SHA-512:	EEC22E3347AFFC0EB0F9452F3B9B239E8B714148A39BE83EBE7979BAC706A942DA3A17DE01E9A1B89DFEC9E970692C3E9FE566750092FC139325AE25ED1C3E04
Malicious:	false
Preview:	........_..j..H..k..I..l..I..n..I..o..I..p.(I..r..I..s.?I..t.HI..v.]I..w.jI..y.pI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J....0J....EJ....VJ....XJ....\J....eJ....uJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K....(K....-K....7K....kK.....K....K..+..K..,..K../..K..0..K..1..L..2.(L..3.9L..4.YL..5..L..6..L..7..L..>..M..?..M..N./M..g.=M..i.@M..j.DM..k.QM..l.\M...]sM...].M...].M...]SN...]YN...].N...].N...].N...].N...].N...]rQ...].Q...].Q...].Q...^.Q...^.Q...^.Q...^.R...^.R...^.R...^.R...^.R...^.S...^.S...^6S...^KS...^bS...^wS...^.S...^.S...^.S...^2T...^FT...^PT...^dT..'^nT..(^.T..)^.T..+^.T..,^.U..-^$U...^5U../^<U..0^YU..1^.U..2^.V..3^.V..4^.W..5^4W..6^dW..7^\|W..:^.W..;^'X..<^.X..=^.X..>^.Y..@^>Y..A^.Y..B^.Z..C^.Z..D^.Z..E^.[..F^:]..G^.^..H^._..I^._..K^.`..M^.`..N^)`..O^2`..P^E`..Q^.`..V^.`..W^.a..X^ea..Y^.a..Z^.a..[^.a..\^gb..]^.b..^^.c..c^Xc..e^cc..f^ic..g^nc..h^.c..i^.c..j^.c..k^.c..l^.c..m^.c..p^.c

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\lv.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	153465
Entropy (8bit):	5.609936843204624
Encrypted:	false
SSDEEP:	3072:pvij24mCJrjE7+Gv9A9kz7dyIs8i5ijAoDfZ18:pvij24mCJ07V9AS7dyIBkijAobZ18
MD5:	28EEEE40B2722E1CC42905C70367FBDB
SHA1:	FD82465B1522D314B295207934A7641B3D257D66
SHA-256:	026E6A4EA0FD11C07375F0532A0756BFFEF585889A71F33243A116C462B0C684
SHA-512:	A99D203CE67A3E5D4F831064F83C730B045FB1EBA47CA804CE6C407E04240F4C51B4114446C3494E2985A1109695533D1B1C5C7594A5555276BE366C07D0B855
Malicious:	false
Preview:	........j...j..I..k..I..l.$I..n.,I..o.1I..p.>I..r.DI..s.UI..t.^I..v.sI..w..I..y..I..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J....!J....4J....JJ....RJ....nJ....pJ....tJ....{J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K....#K....5K....=K....HK....yK.....K..*..K..+..K..,..K../..K..0..K..1.4L..2.EL..3.PL..4.fL..5..L..6..L..7..L..>..L..?..M..N..M..g..M..i..M..j.#M..k.(M..l.0M...]5M...]^M...]zM...]&N...]-N...]MN...]jN...].N...].N...].N...].P...].P...].P...].P...^.P...^.P...^$Q...^TQ...^.Q...^.R...^.R...^>R...^MR...^qR...^zR...^.R...^.R...^.R...^.S...^.S...^fS...^.S...^.S...^.S...^.S..'^.S..(^.S..)^.T..+^QT..,^{T..-^.T...^.T../^.T..0^.T..1^.T..2^jU..3^.U..4^NV..5^nV..6^.V..7^.V..:^.V..;^TW..<^.X..=^2X..>^UX..@^.X..A^.X..B^.Y..C^.Y..D^.Y..E^.Z..F^.\..G^.]..H^.]..I^.^..K^3^..M^9^..N^G^..O^R^..P^_^..Q^.^..V^.^..W^.^..X^X_..Y^u_..Z^._..[^._..\^.`..]^c`..^^.`..c^.`..d^.`..e^.`..f^.`..g^.`..h^.a..i^2a..j^Ya..k^Za..l^pa..m^sa

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ml.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	345375
Entropy (8bit):	4.318830515196368
Encrypted:	false
SSDEEP:	1536:ukvjrC/9IJFlYBkPQ4z6NWdWMQTW1fp3ut:uk7W/ybPQE6NWdWZTaB3ut
MD5:	A7F6CDC17EDDC1550260489D478EC093
SHA1:	3308EB8F7D1958FE6B9F94602599CDC56460AA89
SHA-256:	01A0E2F809FED45B9B67831202D297C3221077FA2DD84F3B635AB33016A07577
SHA-512:	42132CA4A62BD5DE5928F8C313C930C1FAB0AD918FE08612CCD118E421ECA768956AD42F7551D6CE58D10BE6C34CAE7A2FEF518BDE9F0641C339F7AF70F42688
Malicious:	false
Preview:	........H.A.j..H..k..H..l..H..n..H..o..H..p..H..r..I..s..I..t..I..v./I..w.<I..y.BI..z.QI..\|.WI..}.iI....qI....vI....~I.....I.....I.....I.....I.....I.....I.....I.....J....JJ.....J.....J.....K....SK....UK....YK.....K.....K.....K.....L....@L....sL.....L.....L.....L.....L.....L.....L.....M....9M....UM.....M.....M.....M.....N.....N....O..+..O..,.3O../.gO..0.wO..1..P..2.6P..3.nP..4..P..5..Q..6..Q..7..Q..>.iR..?..R..N..R..g..R..i..R..j..R..k..R..l..R...].R...]~S...].S...].U...].U...],V...]cV...].V...]=W...]kW...]eY...].Y...].Y...].Y...^.Z...^0Z...^{Z...^.Z...^.\...^.\...^.]...^.]...^.]...^.]...^.^...^I^...^.^...^.^...^r_...^._...^W`...^.a...^Ta...^sa...^.a..'^.a..(^.a..)^.b..+^.b..,^3c..-^dc...^.c../^.c..0^.d..1^.d..2^.e..3^.f..4^+h..5^ih..6^.h..7^.i..:^gi..;^.j..<^(m..=^?m..>^.m..@^-n..A^to..B^.p..C^.p..D^.q..E^lq..F^8t..G^Ku..H^v..I^.v..K^Qw..M^lw..N^.w..O^.w..P^.w..Q^Zx..V^ly..W^.y..X^.{..Y^,{..Z^.{..[^.\|..\^.\|..]^.}..^^.~..c^....e^X...f^d...g^v...h^....i^....j^I...k^J...l^....m^....p^..

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\mr.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	284611
Entropy (8bit):	4.36914070069881
Encrypted:	false
SSDEEP:	3072:0j57j1LKAbBeM49D/Wcq02RCuXaIuc7nNSZhZ9K3MxeFlWSLQMDdjB3rhPXyYH6z:0j91L1Cujy
MD5:	BE22080B1E45301C313D92D825A7A9ED
SHA1:	84C9370A4845DDFA1EAB8AE334C1F4CC02FFABA6
SHA-256:	C09D274406A36F90C75A1DAF018C5373D697C42BBC20771A827F62EBE08DAB57
SHA-512:	9558690AE7AC41984553AEA1E0133778301EE12E0DD6E16F5DC0380619B82A7A8D37CBE0EF59EFCD53C05987ED6FDEB869DEE8FE2224FDA8880D473E932C2F87
Malicious:	false
Preview:	........0.Y.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..H..t..H..v..H..w..I..y..I..z.!I..\|.'I..}.9I....AI....FI....NI....VI....^I....eI....lI....sI....tI....uI.....I.....J....6J....UJ....gJ.....J.....J.....J.....J.....J....'K....CK....bK.....K.....K.....K.....K.....K.....K.....K.....L.....L....L....GL....VL....eL.....L.....L....M..+.!M..,.?M../..M..0..M..1..N..2..N..3.2N..4.oN..5..N..6..O..7.BO..>..O..?..O..N..O..g..O..i..O..j..O..k..O..l..P...].P...]kP...].P...].R...]:R...].R...].R...]"S...]HS...].U...]IU...]RU...]dU...^.U...^.U...^.U...^QV...^NW...^.W...^.W...^.X...^*X...^YX...^rX...^.X...^.X...^.X...^.Y...^.Y...^.Z...^.Z...^.[...^.[...^9[..'^R[..(^.[..)^.[..+^.\..,^.\..-^.\...^;]../^W]..0^.]..1^.^..2^._..3^.`..4^.`..5^(a..6^~a..7^.a..:^.a..;^Nc..<^&e..=^=e..>^ve..@^.e..A^Kg..B^=h..C^.h..D^.h..E^.i..F^Rk..G^Zl..H^Jm..I^.m..K^4n..M^Jn..N^fn..O^xn..P^.n..Q^.o..V^.o..W^ p..X^.q..Y^Oq..Z^.q..[^.r..\^.r..]^.s..^^.t..c^.t..d^.u..e^6u..f^Eu..g^Qu..h^.u..i^.u..j^.v..k^.v..l^Gv..m^Jv..p^.v

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ms.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	131776
Entropy (8bit):	5.23641513662631
Encrypted:	false
SSDEEP:	1536:kvCULU6TUyT4CEiix3xDEr+9eX2jBS9ssQQPYOY9vSi3765/3+8u8Jyu:gTTp4CEiO3xDE3X2jBSaj36o8u8Jyu
MD5:	BFF5EA1DBEDFAB0DA766909C2B0BEED3
SHA1:	9AB6989C47AB4CEA0D620FE70BBA5C1E15A58A51
SHA-256:	6240E885116732AE850542CAB40C80950BF83171C17A84BF02D7DF9B1A2A98A4
SHA-512:	8BC32F7BADE04932B51A2BC4E8D5D609D379A157ACCCA63E43977A19F2604E87BA754BF545651A1237C74E05577F36D85E53D20FA1DA41E7967E8EF8A657464D
Malicious:	false
Preview:	........\.-.j..H..k..H..l..I..n..I..o..I..p."I..r.(I..s.9I..t.BI..v.WI..w.dI..y.jI..z.yI..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....8J....FJ....]J...._J....cJ....lJ....vJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K.....K....&K....-K....[K....pK..*.~K..+..K..,..K../..K..0..K..1..K..2..K..3..L..4.%L..5.8L..6.tL..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].M...] M...].M...].M...].M...].M...](N...]7N...].O...]%O...],O...]2O...^CO...^JO...^^O...^.O...^.P...^,P...^1P...^RP...^ZP...^vP...^~P...^.P...^.P...^.P...^.P...^.Q...^:Q...^`Q...^sQ...^.Q...^.Q..'^.Q..(^.Q..)^.Q..+^.R..,^$R..-^0R...^8R../^?R..0^XR..1^~R..2^.R..3^JS..4^.S..5^.S..6^.S..7^.S..:^.T..;^.T..<^AU..=^PU..>^`U..@^.U..A^.U..B^RV..C^fV..D^tV..E^.V..F^.W..G^.X..H^sX..I^.X..K^.X..M^.X..N^.X..O^.X..P^.X..Q^.Y..V^`Y..W^.Y..X^.Y..Y^.Y..Z^.Y..[^)Z..\^.Z..]^.Z..^^"[..c^D[..e^J[..f^O[..g^T[..h^f[..i^}[..j^.[..k^.[..l^.[..m^.[..p^.[..q^.[

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\nb.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	129811
Entropy (8bit):	5.41466631045413
Encrypted:	false
SSDEEP:	1536:KGw/e+4IRu0YenTKG4I8liXbuzqF6I9Im8VUvCAepd9nNMR0b:1jZenGxI8SuzqF6I9IwCnp/nNsW
MD5:	2F31DBF3F36906C58B68F7F88C433257
SHA1:	55552671F81A9B24EF05D16249BCF5135D5A98C9
SHA-256:	CA435B5CA91A253129BDE2155592D9C3876005C4CA4389E4ECF97ADAB9A6DE4A
SHA-512:	079EA4F01582E9AB05E2C63850B654AB84CE3B8BB72390899DFE662E2C4138B82F869829FAD3EE645546DD8E27C749D2EF20A0D5BC94DB174A59C6E0D43EA27C
Malicious:	false
Preview:	........V.3.j..H..k..H..l..H..n..I..o..I..p..I..r..I..s.-I..t.6I..v.KI..w.XI..y.^I..z.mI..\|.sI..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J....5J....7J....;J....@J....GJ....RJ...._J....jJ....\|J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K..*..K..+.!K..,.?K../.PK..0.UK..1..K..2..K..3..K..4..K..5..K..6..L..7..L..>.:L..?.?L..N.KL..g.WL..i.ZL..j.^L..k.eL..l.jL...]oL...].L...].L...]eM...]kM...].M...].M...].M...].M...].M...].N...].N...].N...].N...^.N...^.N...^.O...^'O...^.O...^.O...^.O...^.P...^.P...^3P...^;P...^NP...^fP...^sP...^.P...^.P...^.Q...^.Q...^AQ...^IQ...^\Q..'^aQ..(^uQ..)^.Q..+^.Q..,^.Q..-^.Q...^.R../^.R..0^%R..1^KR..2^.R..3^/S..4^.S..5^.S..6^.S..7^.S..:^.S..;^PT..<^.T..=^.T..>^.U..@^6U..A^.U..B^.V..C^.V..D^.V..E^9V..F^'W..G^.W..H^.X..I^PX..K^nX..M^tX..N^\|X..O^.X..P^.X..Q^.X..V^.X..W^&Y..X^.Y..Y^.Y..Z^.Y..[^.Z..\^iZ..]^.Z..^^.Z..c^'[..e^.[..f^4[..g^7[..h^K[..i^c[..j^t[..k^u[..l^.[..m^.[..p^.[

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\nl.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	134663
Entropy (8bit):	5.3406894485410845
Encrypted:	false
SSDEEP:	3072:wYSSmVmPYN5L3OUDjhJkkmP0l/gHkIINejANTie85XoknV:tSSa1OimmbjOnV
MD5:	1E5B9D923D5F8CEF49C913BADD2784BA
SHA1:	6E42A558A7207B2CEE2452263EB661843FE74D0D
SHA-256:	7A7BE29044BF2FA9459A90DCCE12ED531931660BA680DEC8F32AD8A3364D973E
SHA-512:	E4392F91392B79FA14C3545C9733DEB128F399163DCBEE698BF51B2218B1ABAB6AEF45C35130545DDC86626012599E4A8BD77205BAA735C957258539C9B6D484
Malicious:	false
Preview:	........].,.j..H..k..H..l..I..n..I..o..I..p.$I..r.I..s.;I..t.DI..v.YI..w.fI..y.lI..z.{I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....J....3J....EJ....GJ....KJ....YJ....fJ....uJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K....!K....(K....UK....gK..*.oK..+.rK..,..K../..K..0..K..1..K..2..K..3..K..4..L..5.1L..6.kL..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].M...]%M...].M...].M...].M...].M...].N...]8N...]HN...](O...]4O...]<O...]BO...^TO...^`O...^.O...^.O...^;P...^nP...^vP...^.P...^.P...^.P...^.P...^.P...^.P...^.Q...^0Q...^CQ...^.Q...^.Q...^.Q...^.Q...^.Q..'^.Q..(^.Q..)^.Q..+^1R..,^OR..-^]R...^kR../^pR..0^.R..1^.R..2^.S..3^.S..4^.S..5^.S..6^&T..7^5T..:^IT..;^.T..<^zU..=^.U..>^.U..@^.U..A^7V..B^.V..C^.V..D^.V..E^.V..F^.W..G^lX..H^.X..I^"Y..K^EY..M^NY..N^]Y..O^eY..P^tY..Q^.Y..V^.Y..W^.Z..X^.Z..Y^.Z..Z^.Z..[^.Z..\^C[..]^.[..^^.[..c^.[..d^.\..e^.\..f^.\..g^.\..h^5\..i^O\..j^a\..k^b\..l^m\..m^p\

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\pl.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	147502
Entropy (8bit):	5.735460180369809
Encrypted:	false
SSDEEP:	1536:3rlLYT1kOURMa8or/1QatCkBjzAzN3OOAYd4KNsNYiiUHYAUfpnyLA:bSkOw1Qa+N3z4NYiiUHYAUfBt
MD5:	BC72C8E2426765839539A3B8340FE19E
SHA1:	630BD0E844E673454477B819C808B7E18BEBE0DB
SHA-256:	6A97C2CE05545607A59DF2F0DAEF5DA71058DC1E1685F26263B7110EDC431755
SHA-512:	A0F2C68EBB8E5E2AB5AD682B5CE0B1DC955ACED7DE32001A0DECFAFB924CA94EF322605DDF69BA74BAF18871CFDDBAD97FC326C43E5B3168019E21912F7DA421
Malicious:	false
Preview:	........b.'.j..H..k..I..l..I..n..I..o.!I..p..I..r.4I..s.EI..t.NI..v.cI..w.pI..y.vI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....&J....;J....CJ....XJ....ZJ....^J....dJ....nJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K...."K....\K....vK..*..K..+..K..,..K../..K..0..K..1..L..2..L..3..L..4.=L..5.[L..6..L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].M...],M...]JM...].M...].M...].N...],N...]?N...]}N...].N...].P...]0P...]7P...]=P...^YP...^cP...^.P...^.P...^:Q...^eQ...^mQ...^.Q...^.Q...^.Q...^.Q...^.Q...^.Q...^3R...^XR...^.R...^.R...^.R...^.R...^.R..'^.S..(^.S..)^#S..+^oS..,^.S..-^.S...^.S../^.S..0^.S..1^.S..2^yT..3^.T..4^XU..5^yU..6^.U..7^.U..:^.U..;^LV..<^.V..=^.W..>^.W..@^VW..A^.W..B^vX..C^.X..D^.X..E^.X..F^.Z..G^.[..H^5\..I^n\..K^.\..M^.\..N^.\..O^.\..P^.\..Q^.\..V^)]..W^M]..X^.]..Y^.]..Z^.]..[^.^..\^[^..]^.^..^^.^..c^._..d^"_..e^,_..f^4_..g^7_..h^J_..i^e_..j^._..k^._..l^._..m^._..p^._

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\pt-BR.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	140711
Entropy (8bit):	5.399539343244414
Encrypted:	false
SSDEEP:	1536:560p+ZnA6WbY3jwD6XDcc4LHwWXCqv5cy0Y0q47c6x0xGU5cQ5iMe7R:gZLzMwDccsdXCOUEOMe9
MD5:	54EFB4172A7110A567AD87F67CFCD551
SHA1:	EA8EAC6F2328B8A1B27249FCED7C16154060DCF3
SHA-256:	C17ED07165EC47DE5ACDFA7E4783AF4B417843E5F232E9F38CE02138C8BD1742
SHA-512:	AE8AA02E9BCB3BFD8B39329A2C37F789484661E283DC63297E1EC2DD5D14558B349C312990048DC6A03CC7040A1C6FEA2571C6102B1A61A638F9AB615F5FC938
Malicious:	false
Preview:	........^.+.j..H..k..I..l..I..n..I..o..I..p.&I..r.,I..s.=I..t.FI..v.[I..w.hI..y.nI..z.}I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....=J....EJ....ZJ....\J....`J....hJ....qJ....{J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K....NK....iK...tK..+.wK..,..K../..K..0..K..1..K..2..K..3..K..4..L..5.7L..6.oL..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].M...]&M...].M...].M...].M...].M...].N...]9N...]HN...].O...].O...].O...].O...^.O...^.O...^.O...^P...^.P...^.P...^.P...^.P...^.P...^.Q...^.Q...^5Q...^EQ...^RQ...^.Q...^.Q...^.Q...^.R...^.R...^.R...^4R..'^:R..(^IR..)^WR..+^.R..,^.R..-^.R...^.R../^.R..0^.S..1^7S..2^.S..3^.T..4^.T..5^.T..6^.T..7^.T..:^.T..;^.U..<^kV..=^.V..>^.V..@^.V..A^4W..B^.W..C^.W..D^.W..E^.W..F^.Y..G^>Z..H^.Z..I^;[..K^a[..M^i[..N^u[..O^.[..P^.[..Q^.[..V^.[..W^$\..X^.\..Y^.\..Z^.\..[^.\..\^A]..]^.]..^^.]..c^.^..e^&^..f^*^..g^-^..h^C^..i^]^..j^n^..k^o^..l^.^..m^.^..p^.^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\pt-PT.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	141510
Entropy (8bit):	5.387039490844644
Encrypted:	false
SSDEEP:	1536:mMkJ686+k89HwqsQX3rRK0ZY/5MQ4zwdQxz2qKHA6XLLaH563sn:mK8vsQX3rwrMQiF6naH563sn
MD5:	F7A822E3DEDAA3DF046C3172613E275D
SHA1:	14C21D2CC296197A9A618F21DC103F0D6749B77F
SHA-256:	E2E84E23275190865C685E0712530245E35DC63FF82C4E854068494192917F3E
SHA-512:	0D08FEDB423E9EA4F9CA54B55FCB6A88C4F4AA7ED71897B4A7625F093E8DC05733EC52E4577709DD4E4C7BE001770E1DC85C0E10E0DAD883F3291C515736B7C1
Malicious:	false
Preview:	........d.%.j..H..k..I..l..I..n. I..o.%I..p.2I..r.8I..s.II..t.RI..v.gI..w.tI..y.zI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....J....?J....GJ....YJ....[J...._J....eJ....sJ....}J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K....'K....ZK....xK....K..+..K..,..K../..K..0..K..1..K..2..L..3..L..4.3L..5.WL..6..L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..M..l..M...].M...]1M...]NM...].M...].M...].M...].N...]+N...]pN...].N...].O...].O...].O...].O...^.O...^.O...^.O...^+P...^.P...^.P...^.P...^.P...^.Q...^(Q...^1Q...^GQ...^gQ...^tQ...^.Q...^.Q...^.R...^9R...^HR...^VR...^nR..'^uR..(^.R..)^.R..+^.R..,^.S..-^ S...^.S../^8S..0^[S..1^.S..2^.T..3^pT..4^.T..5^.U..6^.U..7^<U..:^XU..;^.V..<^.V..=^.V..>^.W..@^GW..A^.W..B^)X..C^EX..D^]X..E^.X..F^.Y..G^.Z..H^.Z..I^.Z..K^.[..M^.[..N^.[..O^'[..P^6[..Q^m[..V^.[..W^.[..X^Y\..Y^.\..Z^.\..[^.\..\^4]..]^x]..^^.]..c^.^..d^.^..e^ ^..f^$^..g^'^..h^?^..i^[^..j^l^..k^m^..l^~^..m^.^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ro.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	144693
Entropy (8bit):	5.433783046509505
Encrypted:	false
SSDEEP:	1536:uo28bUMKGVSwPku93pk6k3aveNmlodyVw9HHDv2QJwwpsPlJtWTXh6jYf9KHD8EG:uX8IUS+kA3ppya2N/Hr2hPGXh6HuvfJ5
MD5:	5F6AF740E111066BA5245A7FB58C3D38
SHA1:	BB09D9F89EC6E1DB0A45CD15F84930DC34011B16
SHA-256:	B9FEE8754A5307751F197D1968DD02E163DBA30F09A36C72F88B63B4EE5BCD26
SHA-512:	D2C74477BFA01E8B5B51FBB4393368DC967BE362833CC2AC61FC989F41896F17B957D10C0E03B442FBA1F3D6059637F355DD6E537E6E00C382EAACFC1B5D64E2
Malicious:	false
Preview:	........O.:.j..H..k..H..l..H..n..H..o..H..p..I..r..I..s..I..t.(I..v.=I..w.JI..y.PI..z._I..\|.eI..}.wI.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J...."J....4J....6J....:J....CJ....NJ....]J....oJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K....PK....nK...zK..+.}K..,..K../..K..0..K..1..K..2..L..3..L..4.L..5.JL..6..L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...] M...]9M...].M...].M...].M...].N...]%N...]eN...]xN...].O...].O...].O...].O...^.O...^.O...^.P...^NP...^.P...^.Q...^.Q...^0Q...^FQ...^{Q...^.Q...^.Q...^.Q...^.Q...^.Q...^.Q...^(R...^PR...^`R...^nR...^.R..'^.R..(^.R..)^.R..+^.R..,^.S..-^)S...^?S../^GS..0^_S..1^.S..2^.T..3^gT..4^.T..5^.T..6^.U..7^ U..:^7U..;^.U..<^`V..=^pV..>^.V..@^.V..A^/W..B^.W..C^.W..D^.W..E^.W..F^ZY..G^.Z..H^.Z..I^.Z..M^.[..N^.[..O^ [..P^/[..Q^Y[..V^.[..W^.[..X^5\..Y^P\..Z^`\..[^.\..\^.\..]^0]..^^.]..c^.]..e^.]..f^.]..g^.]..h^.]..i^.]..j^.^..k^.^..l^.^..m^.^..p^-^..q^U^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ru.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	230803
Entropy (8bit):	4.880792707330682
Encrypted:	false
SSDEEP:	6144:KYbEaX+n/uRHC4Hjn+T52wdOrst488QgIv7RX9oyMUZQLv9IMTYDdVxfA:zEaX+n/uRHC4Hjn+T52wdOrst488QgIK
MD5:	822750AB24D9EF1A54F3D987EEE1ACB5
SHA1:	DC99948CFD029CC9D98C10E487625832DB8F1855
SHA-256:	3906F069E6E2A3A0235826E9382624E7A4CFBA309F00BBD0963FF0C9F2C179FA
SHA-512:	B0D9521E088C80470E5D15E310BF7E3E27B16464C5349F2BD6F29A78E7FDC7DA36B3B1BEE68E4496585B0E2F20098FA6B0B3360C4B43F2ED9718D292755F5BE4
Malicious:	false
Preview:	........,.].j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..H..t..H..v..H..w..I..y..I..z..I..\|..I..}.1I....9I....>I....FI....NI....VI....]I....dI....kI....lI....mI.....I.....I.....I.....J....!J....HJ....JJ....NJ....ZJ....sJ.....J.....J.....J.....J.....K.....K.....K.....K...."K....6K....NK....\K....qK.....K.....K.....K.....K....'L..*.8L..+.;L..,.YL../.vL..0..L..1..L..2..L..3..M..4.AM..5.xM..6..M..7..N..>.:N..?.IN..N.hN..g.xN..i.{N..j..N..k..N..l..N...].N...].N...].O...].P...].P...]lP...].P...].P...].Q...]1Q...]%U...]NU...]\U...]jU...^~U...^.U...^.U...^.V...^.V...^(W...^4W...^.W...^.W...^.W...^.W...^.X...^)X...^?X...^.X...^.X...^WY...^.Y...^.Y...^.Y...^.Y..'^.Y..(^.Z..)^3Z..+^.Z..,^.Z..-^.Z../^.[..0^6[..1^u[..2^~\..3^#]..4^.]..5^.]..6^4^..7^N^..:^.^..;^._..<^.`..=^.`..>^.`..@^Oa..A^+b..B^rc..C^.c..D^.c..E^.c..F^.g..G^Ci..H^.j..I^.k..M^Fk..N^[k..O^.k..P^.k..Q^.k..V^nl..W^.l..X^Nm..Y^um..Z^.m..[^.m..\^zn..]^.n..^^to..c^.o..e^.o..f^.o..g^.o..h^.p..i^6p..j^ep..k^fp..l^.p..m^.p..p^.p..q^.q..r^Sq

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\sk.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	149684
Entropy (8bit):	5.76737201509727
Encrypted:	false
SSDEEP:	3072:AECQqENgyHHraQUjZLF1qkM+zBHCYWGrG45Pa:0gNnHraQUjZL7GJ
MD5:	7CEDCF98E68F4001CC13F2B761571681
SHA1:	FBA32C46564452FEE5697777B6D3C60D69589528
SHA-256:	E6509F7A6C6B9912F2875C7EFA34434AB9562DF3CDCAF0546B6370D594CA46FB
SHA-512:	C90CA580C5DA2FFF68B5957940D9B2C377CB07632B1FC0C8A23FEF9A076CD05DA618890F197F5B2F7314583FBA89BE083AD180335201D28C27A7C8C21A55C72C
Malicious:	false
Preview:	........a.(.j..H..k..I..l..I..n..I..o..I..p.,I..r.2I..s.CI..t.LI..v.aI..w.nI..y.tI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....'J....9J....NJ....cJ....eJ....iJ....oJ....zJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K....#K....K....cK....}K....K..+..K..,..K../..K..0..K..1..K..2..L..3..L..4.6L..5.UL..6..L..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].M...]/M...]OM...].M...].N...]4N...]HN...]^N...].N...].N...][P...]mP...]uP...]{P...^.P...^.P...^.P...^.P...^\|Q...^.Q...^.Q...^.Q...^.Q...^.R...^.R...^&R...^RR...^fR...^.R...^.R...^.R...^.S...^0S...^=S...^PS..'^XS..(^gS..)^uS..+^.S..,^.S..-^.S...^.T../^.T..0^%T..1^TT..2^.T..3^:U..4^.U..5^.U..6^.U..7^.U..:^.V..;^.V..<^^W..=^mW..>^.W..@^.W..A^=X..B^.X..C^.Y..D^.Y..E^3Y..F^.[..G^.\..H^.\..I^,]..K^M]..M^U]..N^d]..O^m]..P^~]..Q^.]..V^.^..W^8^..X^.^..Y^.^..Z^.^..[^.^..\^V_..]^._..^^._..c^.`..d^.`..e^#`..f^)`..g^,`..h^?`..i^V`..j^o`..k^p`..l^.`..m^.`..p^.`

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\sl.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	142373
Entropy (8bit):	5.450298547452688
Encrypted:	false
SSDEEP:	3072:DHw4EXovSNw1uW34rKKGxIqTCOXi/fzszZvqu:zw4zSu3lKGxIUi/fzsNvqu
MD5:	C08D0D08FD48822C603A27AAAD4E9557
SHA1:	8B7D616EF86BD955CBDF68197CDF748AAF99240A
SHA-256:	EF205CF8911A96D772711675E75BC8DF5866CE0D9D44EBB110BC07E4F340FF65
SHA-512:	480A23A25860616BE8844CE29042FA15CC7F360E2C53B367F6701926B9A6DF72D82AD6C5DC7C0FAFD537202D4EA7C44DFE24589FB4A4F52B4440629865F8C19E
Malicious:	false
Preview:	........S.6.j..H..k..H..l..H..n..H..o..I..p..I..r..I..s.'I..t.0I..v.EI..w.RI..y.XI..z.gI..\|.mI..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....'J....:J....<J....@J....JJ....UJ...._J....rJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J....(K....CK..*.OK..+.RK..,.pK../..K..0..K..1..K..2..K..3..K..4..L..5..L..6.VL..7.nL..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...].L...].M...].M...].M...].M...].M...].N...]?N...]NN...]9P...]LP...]SP...]hP...^.P...^.P...^.P...^.P...^\|Q...^.Q...^.Q...^.Q...^.Q...^.R...^.R...^4R...^TR...^{R...^.R...^.R...^.S...^"S...^+S...^GS..'^MS..(^fS..)^tS..+^.S..,^.S..-^.S...^.T../^.T..0^+T..1^OT..2^.T..3^+U..4^.U..5^.U..6^.U..7^.U..:^.U..;^cV..<^.V..=^.W..>^%W..@^XW..A^.W..B^.X..C^.X..D^.X..E^.X..F^.[..G^.\..H^.]..I^.]..K^.]..M^.]..N^.^..O^.^..P^.^..Q^?^..V^.^..W^.^..X^.^..Y^._..Z^#_..[^]_..\^._..]^._..^^=`..c^]`..d^c`..e^j`..f^o`..g^s`..h^.`..i^.`..j^.`..k^.`..l^.`..m^.`..p^.`

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\sr.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	218369
Entropy (8bit):	4.821449441901466
Encrypted:	false
SSDEEP:	3072:RgAswQLHL49joFDq949M6oG3LFYJvajlw+f1SyTxSWXD437eV7thBn0yhtKlQJ+O:hoDT9M6ia+6Sws37ezn5tEffJ/k/ZD
MD5:	7CFB6DD166594DF07BCCB7C08774A667
SHA1:	1C06A8ADB81C357909ADE0307A67A122C94C0CB7
SHA-256:	C3B5C6965AFFB7F30DCDB5FDB485767E83F3B5D694865A677783C64E3B84934D
SHA-512:	92FEBE5A65C90F105BD7609E2EFF2626BF0E22B186D73D6C1AEB0497E49D9C34B2BB22D26E0ABDE4713DA2C7CF51296723694EE9BC1DECC5071A5225F60E650C
Malicious:	false
Preview:	........b.'.j..H..k..I..l..I..n..I..o.!I..p..I..r.4I..s.EI..t.NI..v.cI..w.pI..y.vI..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I....(J....RJ....uJ.....J.....J.....J.....J.....J.....J.....K....)K....JK....mK.....K.....K.....K.....K.....K.....K.....K.....K.....K.....L.....L...."L....2L.....L.....L..*..L..+..L..,..L../..M..0. M..1..M..2..M..3..M..4..M..5..N..6..N..7..N..>..N..?..N..N..O..g.&O..i.)O..j.-O..k.2O..l.@O...]EO...].O...].O...].P...].P...],Q...]JQ...]rQ...].Q...].Q...].T...].T...].T...].T...^.U...^.U...^HU...^.U...^.V...^.V...^.W...^TW...^sW...^.W...^.W...^.W...^1X...^HX...^.X...^.X...^VY...^.Y...^.Y...^.Y...^.Y..'^.Z..(^;Z..)^XZ..+^.Z..,^$[..-^H[...^o[../^{[..0^.[..1^.[..2^.\..3^L]..4^.]..5^.^..6^L^..7^e^..:^.^..;^J_..<^U`..=^n`..>^.`..@^.`..A^.a..B^.b..C^.b..D^.c..E^?c..F^hf..G^.g..H^.i..I^\|i..K^.i..M^.i..N^.i..O^.i..P^.j..Q^>j..V^.j..W^.j..X^.k..Y^.k..Z^.k..[^-l..\^.l..]^;m..^^.m..c^.m..d^.m..e^.n..f^.n..g^#n..h^Ln..i^rn..j^.n..k^.n..l^.n..m^.n

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\sv.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	130451
Entropy (8bit):	5.4960426005543
Encrypted:	false
SSDEEP:	3072:UzBxJg5kf9KPmp1sWZtgKqrAuxHcShbCeSAOb1+XWk8B:UzPJB9vpWObV
MD5:	B4D3AB3791E862711986BB585C1676FC
SHA1:	2123C8879A70728657E72415D7056AAC4A1527E2
SHA-256:	080CE56662A0A32A4164BA88F9C5081D7C43DC1908412368A70E789E1ADCBF66
SHA-512:	B904F1741079A8C7ED7647EFE42E9D7B9BE403079DE7E512539B70BC653E55420A3ACA4B599E8A9D440245A61F94124476B3A5AFA43B39FF1AA48CB48FC5C15D
Malicious:	false
Preview:	........S.6.j..H..k..H..l..H..n..H..o..I..p..I..r..I..s.'I..t.0I..v.EI..w.RI..y.XI..z.gI..\|.mI..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....'J....;J....=J....AJ....GJ....NJ....VJ....dJ....qJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K...'K..+.K..,.HK../.TK..0.nK..1..K..2..K..3..K..4..K..5..K..6.#L..7.5L..>.EL..?.NL..N.^L..g.jL..i.mL..j.qL..k.vL..l.{L...].L...].L...].L...]gM...]nM...].M...].M...].M...].M...].M...].N...].N...].N...].N...^.N...^.O...^DO...^tO...^.O...^.P...^.P...^BP...^JP...^\P...^eP...^uP...^.P...^.P...^.P...^.P...^4Q...^WQ...^fQ...^nQ...^.Q..'^.Q..(^.Q..)^.Q..+^.Q..,^.R..-^$R...^0R../^5R..0^SR..1^.R..2^.R..3^GS..4^.S..5^.S..6^.S..7^.T..:^%T..;^.T..<^NU..=^`U..>^oU..@^.U..A^.V..B^kV..C^tV..D^.V..E^.V..F^.W..G^.X..H^.X..I^.X..K^.X..M^.X..N^.X..O^.Y..P^.Y..Q^9Y..V^.Y..W^.Y..X^.Z..Y^.Z..Z^-Z..[^SZ..\^.Z..]^.Z..^^4[..c^[[..d^d[..e^m[..f^s[..g^v[..h^.[..i^.[..j^.[..k^.[..l^.[..m^.[

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\sw.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	137154
Entropy (8bit):	5.302768584935173
Encrypted:	false
SSDEEP:	3072:fatfGmt5JXHIYC9tUDiGyp0jcHZPXQtVPGqLej+hKfHw8L:5mt5stUDiGGHyWj+hKfHw8L
MD5:	A5F4010DE863114025B898D78036B336
SHA1:	0FA93FEE8F60D1BF2FEC4E01C5306404E831E94C
SHA-256:	8C58ADBFF7D672154C6F399EA29B549005460D80679E1F6CF997D95732857C30
SHA-512:	7F8B00AE7718F39C0AB91F3F63A3B5062D9878F224417282C3FF43AE9C88562A045C54F7C6F9F7447119A16BFD0EC40B48F762A52B64BC384EC80F53898C53C8
Malicious:	false
Preview:	........Y.0.j..H..k..H..l..I..n..I..o..I..p..I..r."I..s.3I..t.<I..v.QI..w.^I..y.dI..z.sI..\|.yI..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J....!J....-J....DJ....FJ....JJ....PJ....]J....oJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K....<K....\K...gK..+.jK..,..K../..K..0..K..1..K..2..K..3..L..4..L..5.:L..6.rL..7..L..>..L..?..L..N..L..g..L..i..L..j..L..k..L..l..L...].L...]!M...]GM...].M...].M...].N...]"N...]oN...].N...].O...].O...].O...].O...^.O...^.O...^.P...^BP...^.P...^.P...^.P...^.Q...^.Q...^cQ...^jQ...^.Q...^.Q...^.Q...^.Q...^.R...^\R...^.R...^.R...^.R...^.R..'^.R..(^.R..)^.R..+^AS..,^sS..-^.S...^.S../^.S..0^.S..1^.S..2^FT..3^.T..4^8U..5^OU..6^.U..7^.U..:^.U..;^IV..<^.W..=^.W..>^0W..@^eW..A^.W..B^8X..C^IX..D^\X..E^.X..F^.Y..G^.Z..H^{Z..I^.Z..K^.Z..M^.Z..N^.Z..O^.[..P^.[..Q^[..V^w[..W^.[..X^.\..Y^.\..Z^/\..[^]\..\^.\..]^.]..^^R]..c^u]..e^.]..f^.]..g^.]..h^.]..i^.]..j^.]..k^.]..l^.]..m^.]..p^.^..q^1^

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ta.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	343860
Entropy (8bit):	4.111194560758072
Encrypted:	false
SSDEEP:	1536:mCPn9VrlyrrEia8QyMwQw+z0vtNiE2k4ca6QVW640akLJXj1oQyz2PtRtBWQmdag:mCPn9TGDG0vgtRxcA27
MD5:	AB1ECE31AFE29124D183B3826C7EF291
SHA1:	E707A983F039310B867BF4B502165F1F512B9818
SHA-256:	5CABDECD2A89BD97782C13D9F5B24550EA00B28750CDB26A7843AF7E75E34B22
SHA-512:	6510D54C2DD177BE19CA6B250E936FE0E26036AEE7BD1D48E141CFFDE743FE03A02BE0CEE22642C3E8A702B2277D7BF307BDE69A863855BC65A55425A1F2F884
Malicious:	false
Preview:	........=.L.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..H..t..I..v..I..w.&I..y.,I..z.;I..\|.AI..}.SI....[I....`I....hI....pI....xI.....I.....I.....I.....I.....I....)J....WJ.....J.....J.....J....5K....7K....;K....YK....xK.....K.....K.....L....ML.....L.....L.....L.....L.....L.....L.....L.....L.....L....?M....WM....\|M.....N....LN...pN..+.sN..,..N../..N..0..N..1.wO..2..O..3..O..4.!P..5..P..6.DQ..7..Q..>..Q..?..Q..N.R..g.CR..i.FR..j.JR..k.OR..l.]R...]bR...].R...].S...].T...].T...]SU...].U...].U...].V...].V...].Y...].Y...].Y...].Y...^$Z...^BZ...^.Z...^"[...^y\...^.\...^.\...^X]...^w]...^.]...^.]...^.^...^A^...^n^...^._...^G_...^-`...^.`...^.`...^.`...^.a..'^.a..(^Na..)^sa..+^Ab..,^.b..-^.b...^.c../^"c..0^.c..1^.d..2^.e..3^.f..4^.g..5^/h..6^.h..7^.i..:^Ni..;^.j..<^.l..=^.l..>^@m..@^.m..A^Do..B^Fp..C^.p..D^.p..E^iq..F^.s..G^0u..H^>v..I^>w..K^.w..M^.w..N^.w..O^.w..P^$x..Q^.x..V^by..W^.y..X^.z..Y^.{..Z^o{..[^.{..\^ }..]^.}..^^.~..c^I...d^s...e^....f^....g^....h^....i^/...j^f...k^g...l^....m^..

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\te.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	319550
Entropy (8bit):	4.328155937035043
Encrypted:	false
SSDEEP:	6144:U7yoDguApFTaJAhJRt7bDDu3+l/gFipPJiTWFGvqdWVuVyJs4CoWfxM9SwTQTwdD:UjguApFTaJAhJRt7bDDu3+l/gFipPJiV
MD5:	42384786FDE254178D9855FCA1D88624
SHA1:	3ADC71526BEB093A67B48C16FD59F277BF8C683F
SHA-256:	75764AFEEFEF5120539C4D95C56F1BF6A5FA7F36752D6CB6E480FB923B95A39F
SHA-512:	B8813764DD602178AE72A5B8537A1B5A2F9BF025F695C4C5906AFE29DABF5031BE6C2255B175481144A8900A7AB7ECB3FC7C8BB49F123BB7B30DE8F0711F6A94
Malicious:	false
Preview:	........R.7.j..H..k..H..l..H..n..H..o..I..p..I..r..I..s.%I..t..I..v.CI..w.PI..y.VI..z.eI..\|.kI..}.}I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I....9J....pJ.....J.....J.....J....HK....JK....VK....rK.....K.....K.....K.....L....9L....rL....yL....\|L....~L.....L.....L.....L.....M.....M....DM....YM....tM.....N....QN..*.xN..+.{N..,..N../..N..0..N..1..O..2..O..3..O..4..P..5.jP..6..P..7..Q..>.{Q..?..Q..N..Q..g..Q..i..Q..j..Q..k..Q..l..R...].R...].R...].R...].T...].T...].T...]CU...].U...]3V...]hV...]=X...]bX...]nX...].X...^.X...^.X...^KY...^.Y...^.[...^g[...^.[...^.[...^.\...^.\...^.\...^.\...^=]...^g]...^.^...^h^...^:_...^._...^._...^._...^.`..'^6`..(^r`..)^.`..+^ia..,^.a..-^.a...^=b../^[b..0^.b..1^.c..2^$d..3^0e..4^Yf..5^.f..6^.f..7^.g..:^cg..;^.i..<^.k..=^2k..>^.k..@^.l..A^\m..B^6n..C^rn..D^.n..E^.o..F^Gq..G^2r..H^.s..I^.s..K^>t..M^`t..N^.t..O^.t..P^.t..Q^Cu..V^.v..W^.v..X^.w..Y^.w..Z^,x..[^.x..\^{y..]^4z..^^.{..c^T{..d^u{..e^.{..f^.{..g^.{..h^.\|..i^M\|..j^.\|..k^.\|..l^.\|..m^.\|

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\th.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	271715
Entropy (8bit):	4.372687693843707
Encrypted:	false
SSDEEP:	6144:k8bxaCJFkcSCkIOArCSGHIqXqWmh+OqeZK8QyYoHw1pZZpUR+5aQoFvktdIpDKIs:NbxasFkcSCkIOArCSGHIqXqWmh+OqeZ4
MD5:	5ABD2A1B2749449A0CBBA60E32393F4F
SHA1:	31097BF4728F752508482C298710CFFECFB78D60
SHA-256:	C666359FC9FA137F6D7F868CCEF01DAC8701B457BB6BB51FCD581185D4BC8780
SHA-512:	094DF53F3BAC23EB384015E8F2500484556B6EBDA0CB62BC12A773DD1D520D82C13CBAD25EEB67FA04CEB209D80144FAC70FE60EB792CFC1A0C5027513B7448F
Malicious:	false
Preview:	..........v.j.\H..k.kH..l.qH..o.yH..p..H..r..H..s..H..t..H..v..H..w..H..y..H..z..H..\|..H..}..H.....H.....I.....I.....I.....I...."I....I....1I....8I....?I....AI.....I.....I.....I.....J....=J.....J.....J.....J.....J.....J.....J.....K....'K....DK....aK....hK....kK.....K.....K.....K.....K.....K.....K.....L.....L.....L.....L....L..+..L..,..M../.0M..0.CM..1..M..2..M..3..N..4.IN..5..N..6..O..7.=O..>.vO..?..O..N..O..g..O..i..O..j..O..k..O..l..O...].P...]`P...].P...].Q...].Q...].R...];R...].R...].R...].T...].U...].U...]5U...^VU...^tU...^.U...^.V...^4W...^pW...^.W...^.W...^.W...^$X...^3X...^WX...^.X...^.X...^MY...^.Y...^DZ...^~Z...^.Z...^.Z...^.[..'^-[..(^T[..)^r[..+^.\..,^Z\..-^.\...^.\../^.\..0^.\..1^;]..2^9^..3^^_..4^.`..5^.`..6^.a..7^&a..:^Ya..;^.b..<^Jd..=^dd..>^.d..@^.e..A^.e..B^.f..C^.f..D^.f..E^7g..F^.i..G^.j..H^~k..I^.k..K^Jl..M^\l..N^nl..O^.l..P^.l..Q^.l..V^wm..W^.m..X^.n..Y^.n..Z^.n..[^>o..\^.p..]^.p..^^gq..c^.q..e^.q..f^.q..g^.q..h^.r..i^Xr..j^yr..k^zr..l^.r..m^.r..p^.r..q^.s..r^*s

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\tr.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	138883
Entropy (8bit):	5.595652021278339
Encrypted:	false
SSDEEP:	3072:h+ceHcXCPitGJmAMvCsPnnNtOLlh74OfkiO8ru0j19S4jidDhdaMEiZOYuZwi1Pi:4RHLJmAGvduMEIGwiB1ln6
MD5:	08B737A1B8ECB81C8EF4D7B8F6B5F503
SHA1:	99D2CDBB720F114051627ACBB79475CCC57CE6A6
SHA-256:	84F08423FC516988761517511D36BF5D3428866965ADDBF3EF4399A80F8278E8
SHA-512:	142C61F08E56A084F335DCF35C543DAB872DEE898C719052FB8D42BE2050C5FE6D9245180FF9D0D0E07CD884DAAAFFA6CCB5428FEE91AE00413E0EA38A5E8C9C
Malicious:	false
Preview:	........f.#.j..I..k..I..l..I..n.$I..o.)I..p.6I..r.<I..s.MI..t.VI..v.kI..w.xI..y.~I..z..I..\|..I..}..I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J....4J....JJ...._J....sJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K.....K.....K.....K....!K....,K....1K....9K....HK....LK....RK.....K.....K..*..K..+..K..,..K../..K..0..K..1..L..2..L..3.-L..4.CL..5.fL..6..L..7..L..>..L..?..L..N..L..g..M..i..M..j..M..k..M..l..M...] M...]JM...]tM...].N...]'N...]EN...]YN...]pN...].N...].N...].O...].O...].O...].O...^.O...^.O...^'P...^YP...^.P...^'Q...^3Q...^eQ...^uQ...^.Q...^.Q...^.Q...^.Q...^.Q...^.R...^3R...^wR...^.R...^.R...^.R...^.R..'^.R..(^.R..)^.R..+^?S..,^eS..-^tS...^.S../^.S..0^.S..1^.S..2^?T..4^.T..5^.T..6^.T..7^.T..:^.U..;^.U..<^cV..=^tV..>^.V..@^.V..A^;W..B^.W..C^.W..D^.W..E^.W..F^"Y..G^.Y..H^.Y..I^0Z..K^OZ..M^UZ..N^fZ..O^oZ..P^}Z..Q^.Z..V^.Z..W^.[..X^t[..Y^.[..Z^.[..[^.[..\^F\..]^.\..^^.\..c^.]..d^.]..e^.]..f^.]..g^.]..h^1]..i^F]..j^e]..k^f]..l^v]..m^y]..p^.]

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\uk.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	233231
Entropy (8bit):	4.921486764568706
Encrypted:	false
SSDEEP:	3072:dQc1JbB3IjU/zDFjqCKTASYsjFzzPlIGgxLNiXEMQOCqPiqrEb4US/a0h:dQc1JbB3IjU/0TFdzcLNiXEoCqPiqVaU
MD5:	8162EC467AC9A8DAC71D22C630A3E6A3
SHA1:	4E9E8F49CBCC5E583B8ACC3A65FFD87818C96E2A
SHA-256:	D1E07AC8B6A6CE53F06C66241D44407F98A1940259883E143A574F28A2AC170F
SHA-512:	E944E3F8F3E9B2C8C6F26E1A7606E441816406AFE031BAC9A5716CE060A63F03E01A95CC365342518629065B07FC72CF23D65AC84F0B58EF100CF9706A239B58
Malicious:	false
Preview:	........N.;.j..H..k..H..l..H..n..H..o..H..p..I..r..I..s..I..t.&I..v.;I..w.HI..y.NI..z.]I..\|.cI..}.uI....}I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J....4J....MJ....wJ.....J.....J.....J.....J.....J.....K....#K....FK....oK.....K.....K.....K.....K.....K.....K.....K.....K.....K.....L....'L....1L....CL.....L.....L....L..+..L..,..L../.:M..0.LM..1..M..2..M..3..M..4. N..5.ON..6..N..7..N..>..N..?..O..N.'O..g.3O..i.6O..j.:O..k.AO..l.MO...]RO...].O...].O...].Q...].Q...]cQ...].Q...].Q...].R...];R...].U...].U...].U...].U...^.V...^%V...^IV...^.V...^.W...^.W...^.W...^EX...^`X...^.X...^.X...^.X...^.X...^.X...^[Y...^}Y...^.Y...^.Z...^3Z...^CZ...^`Z..'^pZ..(^.Z..)^.Z..+^/[..,^y[..-^.[...^.[../^.[..1^.[..2^.\..3^W]..4^.^..5^Y^..6^.^..7^.^..:^._..;^._..<^.a..=^7a..>^[a..@^.a..A^.b..B^)d..C^6d..D^Md..E^.d..F^.h..G^.j..H^0l..I^.l..K^.l..M^.l..N^.l..O^.m..P^"m..Q^bm..V^.m..W^/n..X^.n..Y^.n..Z^&o..[^.o..\^p..]^.p..^^.q..c^qq..e^.q..f^.q..g^.q..h^.q..i^.q..j^)r..k^*r..l^Er..m^Hr..p^nr..q^.r

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\ur.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	204639
Entropy (8bit):	5.2007888153256445
Encrypted:	false
SSDEEP:	3072:9WEBWVxEJGbAZ1PRXS3cBEQYryfng7Ha10unBSco/9NjjFpv2W3nW/I:cFxEAOPWciQYryWu0co/9NjjFpvpWQ
MD5:	30CE113BC3C466751BDF8D50CC568FF8
SHA1:	D0B434B8F196A320995F49845D64054DCAEDB97F
SHA-256:	34D46D28AF3012BB84767A418957F12D877789B88A13EA29B047C7926ABAFB41
SHA-512:	A8139D60E498082C122B068A478038E3D3A7D6FA71BB8CD2B1BD7976827FFC23F7117F989B18D600960B222178351F01DBFA0FCDC3E7F0917CD0D47B5902FB44
Malicious:	false
Preview:	........@.I.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..I..t..I..v..I..w.,I..y.2I..z.AI..\|.GI..}.YI....aI....fI....nI....vI....~I.....I.....I.....I.....I.....I.....J....#J....=J....[J....eJ.....J.....J.....J.....J.....J.....J.....J.....J.....K....8K....?K....BK....CK....VK....eK....vK.....K.....K.....K.....K.....K....%L....SL..*.dL..+.gL..,..L../..L..0..L..1..M..2. M..3.<M..4.iM..5..M..6..M..7.#N..>.^N..?.kN..N..N..g..N..i..N..j..N..k..N..l..N...].N...].N...]2O...]\P...]mP...].P...].P...].P...]BQ...]ZQ...].R...].R...].R...].S...^.S...^<S...^oS...^.S...^.T...^.T...^.T...^'U...^8U...^XU...^kU...^.U...^.U...^.U...^GV...^qV...^.V...^!W...^:W...^MW...^\W..'^oW..(^.W..)^.W..+^.X..,^oX..-^.X...^.X../^.X..0^.X..1^%Y..2^.Y..3^.Z..4^f[..5^.[..6^.[..7^.[..:^.\..;^.]..<^[^..=^v^..>^.^..@^.^..A^._..B^.`..C^.`..D^.`..E^.`..F^_b..G^:c..H^.c..I^Od..K^.d..M^.d..N^.d..O^.d..P^.d..Q^.e..V^.e..W^.e..X^sf..Y^.f..Z^.f..[^.f..\^.g..]^Ih..^^.h..c^.i..d^%i..e^8i..f^>i..g^Di..h^ui..i^.i..j^.i..k^.i..l^.i..m^.i

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\vi.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	165529
Entropy (8bit):	5.759272509515678
Encrypted:	false
SSDEEP:	3072:VFG1hKMPn2ZPiz+sJoO4294sN+U2cSKQa1bwNgqnziL8LEEpW8LTtdLpFeS+pyD6:rG1/xzosN+U2obMXzigLR/L2
MD5:	247E8CFC494FD37D086DB9A747991ABC
SHA1:	BDC53C042A1C4BC2EBED6781B1B01091C8FB7A92
SHA-256:	4C4E69AF3D7F7012E3CB19BA386FC69EDD0C87CCD9BE326DD6DB902401D123F3
SHA-512:	852DDEB1CE8DBF13280E9DFA72DD10B646F8B06CAF88055AEAB32009F3FDC397A05764BE48A04730E16F23C931D069880574D8BF9C7F4EF151E1D47467A7D60D
Malicious:	false
Preview:	........E.D.j..H..k..H..l..H..n..H..o..H..p..H..r..H..s..I..t..I..v.)I..w.6I..y.<I..z.KI..\|.QI..}.cI....kI....pI....xI.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J....6J....8J....<J....FJ....QJ....bJ....xJ.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....J.....K.....K...."K....WK....vK..*..K..+..K..,..K../..K..0..K..1..K..2..L..3..L..4.3L..5.HL..6..L..7..L..>..L..?..L..N..L..g..L..i..M..j..M..k..M..l..M...].M...]JM...]oM...]4N...]=N...]nN...].N...].N...].N...].P...]$P...]4P...]EP...^iP...^tP...^.P...^.P...^.Q...^.Q...^.Q...^.R...^1R...^YR...^eR...^wR...^.R...^.R...^.S...^ES...^.S...^.S...^.S...^.S...^.T..'^.T..(^.T..)^.T..+^.T..,^.T..-^.T...^.T../^.T..0^.T..1^<U..2^.U..3^IV..4^.V..5^.V..6^.W..7^$W..:^<W..;^.W..<^.X..=^.X..>^.Y..@^JY..A^.Y..B^2Z..C^IZ..D^ZZ..E^\|Z..F^.[..G^H\..H^.\..I^.]..K^3]..M^8]..N^A]..O^T]..P^^]..Q^.]..V^.]..W^.^..X^.^..Y^.^..Z^.^..[^.^..\^`_..]^._..^^"`..c^L`..d^W`..e^``..f^f`..g^j`..h^.`..i^.`..j^.`..k^.`..l^.`..m^.`..p^.a

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\zh-CN.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	119036
Entropy (8bit):	6.661560096138896
Encrypted:	false
SSDEEP:	1536:fwtiYPXW1dGAXHk109nKyOTe1FxWBcJnku9YEQdNlmS:f3YPXiGAXHk109nKyoeXAW22enlmS
MD5:	A55307F02A094632CDC278A86897DCB4
SHA1:	E5009CB6B96906D0267349E94CE187B4B73F7D76
SHA-256:	E8F4CDC11E34FB557148BEAD1EABFE381E9296DD32DF3EEFCFFC1472FB674CEE
SHA-512:	1EAF5A14B908EA29833CAF655E81ED62EB197E797AE6842C0CB140BF69168AEC3F79701786B1FDEB1B9AB78A67D4357006294247FC78341DD0EE62BB9BAE6A81
Malicious:	false
Preview:	..........y.j.VH..k.eH..l.lH..m.tH..o.zH..p..H..r..H..s..H..t..H..v..H..w..H..\|..H..}..H.....H.....H.....H.....H.....I.....I.....I.....I....&I....(I....VI...._I....kI....}I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J.....J.....J....!J....'J....-J....7J....AJ....GJ....MJ....zJ.....J..*..J..+..J..,..J../..J..0..J..1..K..2.&K..3.2K..4.GK..5.hK..6..K..7..K..>..K..?..K..N..K..g..K..i..L..j..L..k..L..l..L...].L...]5L...]JL...].L...].L...].L...].L...]%M...]1M...].N...].N...]#N...]/N...^>N...^DN...^bN...^.N...^.N...^.O...^.O...^BO...^NO...^lO...^rO...^~O...^.O...^.O...^.O...^.O...^;P...^hP...^tP...^.P...^.P..'^.P..(^.P..)^.P..+^.Q..,^2Q..-^AQ...^MQ../^SQ..0^bQ..1^.Q..2^.R..3^.R..4^.S..5^.S..6^AS..7^MS..:^_S..;^.S..<^.T..=^.T..>^.T..@^.T..A^JU..B^.U..C^.U..D^.U..E^.U..F^.V..G^4W..H^.W..I^.W..K^.W..M^.W..N^.W..O^.W..P^.W..Q^1X..V^}X..W^.X..X^.X..Y^.Y..Z^0Y..[^kY..\^.Y..]^.Z..^^fZ..c^.Z..d^.Z..e^.Z..f^.Z..g^.Z..h^.Z..i^.Z..j^.Z..k^.Z..l^.Z..m^.[..p^.[..q^V[..r^p[

C:\Users\user\AppData\Local\Microsoft\Teams\current\locales\zh-TW.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	118312
Entropy (8bit):	6.659894916214185
Encrypted:	false
SSDEEP:	3072:DWsNZGvZ82hdmOXfT/Cs0iXAf/N/9XiPA5QcGoHwTP:CsN0f5f+8Xm/9yLTP
MD5:	96620581F25AC84DDD4B9D0CD29B0749
SHA1:	6413FAF7B2E31755674F27DE8CDAB0788488526C
SHA-256:	2A674D423322D1772E97A627F1E291EFBA5F12B7EFD0F174CDC99D1B1B376988
SHA-512:	7FD315CA93B431C59F92D31B803571EFFC5D758A52FC5D2F797A306FA63EA73162AC91805A892479B6940582AADC8903BDEA6BB70168D660D58525BCA4202520
Malicious:	false
Preview:	..........{.j.RH..k.aH..l.lH..n.tH..o.yH..p..H..r..H..s..H..t..H..v..H..w..H..y..H..z..H..\|..H..}..H.....H.....H.....I.....I.....I.....I...."I....$I....\I....eI....qI.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....I.....J.....J.....J.....J....&J....2J....8J....>J....HJ....XJ....^J....dJ.....J.....J..*..J..+..J..,..J../..J..0..J..1..K..2..K..3.:K..4.RK..5.sK..6..K..7..K..>..K..?..K..N..K..g..L..i..L..j..L..k..L..l..L...].L...]FL...]aL...].L...].L...]-M...]<M...]NM...]uM...].M...]LN...]^N...]dN...]pN...^.N...^.N...^.N...^.N...^5O...^\O...^hO...^.O...^.O...^.O...^.O...^.O...^.O...^.O...^:P...^XP...^.P...^.P...^.P...^.P...^.P..'^.P..(^.P..)^.Q..+^`Q..,^.Q..-^.Q...^.Q../^.Q..0^.Q..1^.Q..2^fR..3^.R..4^QS..5^`S..6^.S..7^.S..:^.S..;^/T..<^.T..=^.T..>^.T..@^(U..A^.U..B^.U..C^.V..D^.V..E^'V..F^.V..G^gW..H^.W..I^.W..K^.X..M^.X..N^.X..O^"X..P^.X..Q^dX..V^.X..W^.X..X^!Y..Y^@Y..Z^OY..[^zY..\^.Y..]^!Z..^^cZ..c^.Z..d^.Z..e^.Z..f^.Z..g^.Z..h^.Z..i^.Z..j^.Z..k^.Z..l^.Z..m^.[..p^.[..q^N[

C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	581192
Entropy (8bit):	6.526392231113294
Encrypted:	false
SSDEEP:	12288:Ssjw3shF+jss1I8CgEWTe5+YMCMGz2MMY5U489wiyaf+QEKZm+jWodEEVksLdS:Ss/5U4RBaf+QEKZm+jWodEECsL0
MD5:	47AC9271F98DE480745F7C0D1B0697F6
SHA1:	945A58D970F90ECCE247C71529DEDF4AB0FDE06F
SHA-256:	2FEBA7BA47871A40D6A7FB6E3BC584D28AF9686F3884C297C3429F257C4ED70D
SHA-512:	05ED53B8C2DD1FA9331DF2BDE994B6B5A1DB364EE230AFF6B9EFAE4A047A48EB72CA803A89F7028A7D1C31EFD6BEA782D8BFAA5ECB92606A9E14F471D9F3B099
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T4...U...U...U...'...U...-8..U...U...U..p/...U..p/...U..p/...U..p/...U..p/...U..p/T..U..p/...U..Rich.U..........PE..d...,pd..........." ... .H...D.......3....................................................`A.........................................H..h...."..,...............8:......HN......8.......p...........................@...@............`...............................text....G.......H.................. ..`.rdata..b....`.......L..............@..@.data...P:...@.......(..............@....pdata..8:.......<...F..............@..@.rsrc...............................@..@.reloc..8...........................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_1.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35432
Entropy (8bit):	6.590864781276069
Encrypted:	false
SSDEEP:	384:Ph1vZLEtU/POoKFYEzWf66uW3kCsbRR2R9zyvGM//NEHRN7kfMR9zlN5m:5pqtcPOj6TKzK9z9MNAk49zlO
MD5:	BBACA184F20FD7EC28D1877CAE222B4F
SHA1:	22FB3367EFE57ACAE8A0EF4D142AEC49102ECC7F
SHA-256:	87E7E1F01A6EEC8BE47A70402FDAE0DE8A624686F9EB4D3330BF8200AB8AEFEA
SHA-512:	B7AD44BB9E9D275203850850D5B4FF4422E02BE2235447BF3AF54902447265A938F9A909B668B69C72E1BE84BD9F16BA1239085167A3E297AC98DAC905039680
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......P.e............................t.......t...........>...t.......t.......t.......t.......t.......Rich............PE..d...YQ............" ... .....&.......................................................%....`A.........................................?..L...<A..x....p.......`.......<..hN...........4..p...........................`3..@............0..8............................text............................... ..`.rdata..2....0......................@..@.data........P......................@....pdata.......`.......2..............@..@.rsrc........p.......6..............@..@.reloc...............:..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_2.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	197192
Entropy (8bit):	6.639708780790847
Encrypted:	false
SSDEEP:	3072:tYRRZqoOwZfxWsy0f8FM0YGal4cxFL24T7bMXm1cF9cr70z5ThmdrhtsGGhxY:twfqoIuf8q0Y2QFLjbM2TegdrvGxY
MD5:	A9BB1D11785D9219048B0A088E1186E5
SHA1:	0E3048D75CE36FE0A1C88857FFE68E94DEBA6277
SHA-256:	C47ACF03E26DFCAEBD5C95E3FF2717D28BE11E71539C3BCE5B2732E59464D197
SHA-512:	92A71EEDC96AA9DB596D34679159E7493DD17F9BD395F3C1BDBF2B5939F71AC8E3B3E2D76D4D4C459D7EA9B8CE38DE925EAE2404E2686A35F0E82450A865AF86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......".C.f.-.f.-.f.-...,.d.-.o...j.-...).n.-.....e.-.f.,...-...,.a.-...(.s.-...-.g.-....g.-.../.g.-.Richf.-.........PE..d.....;..........." ... ..................................................................`A................................................X...........................HN...........M..p............................K..@...............P............................text...+........................... ..`.rdata..6...........................@..@.data...............................@....pdata..............................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_atomic_wait.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	66664
Entropy (8bit):	5.683410421031462
Encrypted:	false
SSDEEP:	768:HHL4+YhCv6vHKOIrHA3X2QLc8Ms9zlpAXF9z6HR:LRPSqOqg3X2QLc81zHAHzWR
MD5:	2B6D99EBD745C68082B88AC9797CBABE
SHA1:	E7763C25941DB6E0042CF3851994CE6683CCFA87
SHA-256:	A2AEFDB61D48AE3506FCFC60FEB5EBA6998F2AC2E4E8B4367979BD768B0E82CA
SHA-512:	107D657988B7164862B2896D44C13D851FD70ACAE3CB93E0926568AE526B0AF89DF8B4F25E9841F82D79F51D471EC016E4011587DA7BD994D5DC352D5E799FE7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Z5...T.P.T.P.T.P.&.Q.T.P.,NP.T.P~..Q.T.P~..Q.T.P.T.P{T.P~..Q.T.P~..Q.T.P~..Q.T.P~."P.T.P~..Q.T.PRich.T.P........................PE..d....2............" ... .:...x.......>.......................................@.......[....`A........................................@f..D....k....... ..........P.......hN...0..\|...pX..p...........................0W..@............P..H............................text...^9.......:.................. ..`.rdata...$...P...&...>..............@..@.data...........B...d..............@....pdata..P...........................@..@.rsrc........ ......................@..@.reloc..\|....0......................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\msvcp140_codecvt_ids.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	30824
Entropy (8bit):	6.844841482505335
Encrypted:	false
SSDEEP:	384:DvhXafwUh8zWhO+KWWCskji9R9zas/NEHRN7Eq/7R9zkV+e:Dsoi7u9zVAtF9z6v
MD5:	0884B235E9F3FCF4D02BE4C02635D136
SHA1:	6C2B17020586540B9BBCD7AAAE6D7418FFBA0A33
SHA-256:	D5242B4798E724DEABAB17015568A394DAF8A85FCBF9AFCEFDA899C8092542D6
SHA-512:	11230FFC6A0B7BFD5462156A9A86550E7A306BFFEA1B7B8DAB768BAFFE4E8CC7E8BA46DF81A460E8825DC294D5B8980BA5D93ED7D29F76976B9A9E9109EE725B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%..)a..za..za..z..{c..zh.5zc..z..{b..za..z@..z..{f..z..{c..z..{m..z..{`..z..Yz`..z..{`..zRicha..z................PE..d.....N..........." ... ............P........................................p............`A........................................p(..0....)..P....P.......@.......*..hN...`..,...."..p............................!..@............ ...............................text............................... ..`.rdata..B.... ......................@..@.data........0....... ..............@....pdata.......@......."..............@..@.rsrc........P.......$..............@..@.reloc..,....`.......(..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources.pak

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	5140957
Entropy (8bit):	7.996440332543967
Encrypted:	true
SSDEEP:	98304:NImTwJrWzlxtvH3u1Zl3oPDLh1fa8OlpSerwrAP5WDj6WzOvKIowBL:N7TyKpxtvXbDLhBa5p/krAWnIow1
MD5:	EC39E11F63DC76F4E0333158F6479269
SHA1:	90B92E03E2C299D241F6E392573EC7643F688197
SHA-256:	5066CEAB1B4A8ED5BD24726DD85A1A21DEBB866800A946267AD6A009451C0F0D
SHA-512:	68E8A2E1F2E62E71660D9D8C77C3DA86044F79AC24AF0472752BBF13447EC6439DAD938D08CEC1CC5504A15A72B9AAAA1828039656890CCDA7E10F91DAF77D4D
Malicious:	false
Preview:	............f.j...h..'.....'.....'.....+.....1.....1.....1.....1...0.1...0?:...0.<...0:N...0.P...0.S...0.T...0.]...0.f...0zh...0.n...0Kq...0.s...0@t...0.u...0.v...0@x...0{}...0....0.....0.....0N....0.....0K....0.....07....0K....0.....0....0.....0.....0.....0.....0.....0:....0.....1.....1.....1,....1)!...1.!...1.&...1.:...7.>...7.I...7`J...7^M...7&R...7.[...7f]...7._...7.s...7.x...7.....7.....7=....7.....7....7H....7j....7.....74....7.....7.....7~....7.....7.....7E....7.....7t....7X....7.....7.....7J....7.....7.....7.....7.....7.....7Y ...7.3...7a?...7.l...7Wt...7-....7G....7Z....7.....7.....7....7?....7.....7[....7.....7.....7.....7.....7.....7.....7.....7P....7a....7.....;`....;.....;a....;.....;.....;.....<.....<.....<e....<.....<.....<^....<~....<"....<'%...<M'...<_Y...<0^...<.e...<.f...<2h...<zq...<Ks...<.u...<$\|...<.....<{....<.....<.....<.....<....<.....<~....<.....<c....I.....I.....I.....I.....I.....I5....I."...I.&...I.(...I.0...I.6...Ii;...I=E...I.K...Iz^...I.p...I.w...IY\|

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\LICENSES.chromium.html

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	5356598
Entropy (8bit):	4.781204754028124
Encrypted:	false
SSDEEP:	12288:FetnBnVncnJnkncnpWQtnwn7n9nJnCnZnGn3eQSnqnBnununFn/nwnJnqnvnOnqo:/PD45W3WSNLbfwVR8mfjF4HSCo/po
MD5:	B8F23E85114316383A2902B55D6460BD
SHA1:	8D387438080B8B0B7450116CF252B127A46E04F2
SHA-256:	5047F9D8B1B24213169DA173E607D9E5242AE2D53246C7660B2D4150A3B1670F
SHA-512:	6523549B119557ADD6EFE03408064B443E0DC2CD64DDF480A1C3F675722DCEBDF793C5C1DFA7CA0C320FC9B4D9BD2B12BE5420A668360AEA9AAAC0F02D0CB46F
Malicious:	false
Preview:	Generated by licenses.py; do not edit. --><!doctype html>.<html>.<head>.<meta charset="utf-8">.<meta name="viewport" content="width=device-width">.<meta name="color-scheme" content="light dark">.<title>Credits</title>.<link rel="stylesheet" href="chrome://resources/css/text_defaults.css">.<link rel="stylesheet" href="chrome://credits/credits.css">.</head>.<body>.<span class="page-title" style="float:left;">Credits</span>.<a id="print-link" href="#" style="float:right;" hidden>Print</a>.<div style="clear:both; overflow:auto;"> Chromium <3s the following projects -->.<div class="product">.<span class="title">2-dim General Purpose FFT (Fast Fourier/Cosine/Sine Transform) Package</span>.<span class="homepage"><a href="http://www.kurims.kyoto-u.ac.jp/~ooura/fft.html">homepage</a></span>.<input type="checkbox" hidden id="0">.<label class="show" for="0" tabindex="0"></label>.<div class="licence">.<pre>Copyright(C) 1997,2001 Takuya OOURA (email: ooura@kurims.kyoto-u.ac.jp)..You may us

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\Resources.pri

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	45984
Entropy (8bit):	5.500299254618878
Encrypted:	false
SSDEEP:	768:bFLcJ2unc9wWsuC4CxBUCx1Hs1BzbLAVRLYDzrKbRH+vr9XraDIWhjvJ:BxssTC4CDUCg1JLMYDzrKbRH+vrdraDh
MD5:	A54E95F05882B842FF38D0DFE56C608F
SHA1:	9228F20811AE38B90F2D4DF777CB48B97425B0AC
SHA-256:	EAC4CF6A1BAB2E28D028703B470B03BB55D171AEC6AC197E88458EF73986BEEC
SHA-512:	6CFF012E0F0DF8D214D343E378F30A304F0539B492CAF33103A0FE0BF64783726D7B1B8205382CA27C7FC7362C94D77056ED21285C3AD7BCA268A5813621F032
Malicious:	false
Preview:	mrm_pri2........ ... ...........[mrm_decn_info].................[mrm_pridescex].............P...[mrm_hschemaex] ........0....@..[mrm_res_map2_]..........A......[mrm_dataitem] ..........T..(Z..[mrm_dataitem] ............@...[mrm_dataitem] .................[mrm_dataitem] .................[mrm_decn_info].....................................................................................................................................................................1.0.0...W.H.I.T.E...B.L.A.C.K...............[mrm_pridescex].........P...................................................P...[mrm_hschemaex] .........@..............[def_hnamesx] .............D.......m.s.-.a.p.p.x.:././.T.e.a.m.s./...T.e.a.m.s.............D...........(@...%..................F..0........A.. .%z.....C..0........P..0~.C.....S.. .%{.....S.. !%\|.....T.. 3%}.....T.. A%~.....T.. T%......U.. m%....'.U.! x%....0.A." ..:...1.A.# ..;.....A. ..<...6.A.( 5.=...-.A.. ^.>...-.A.. ~.?...-.A.. ..@.../.A.! ..A...-.A.. ..B...4.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\ThirdPartyNotice.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2046), with CRLF line terminators
Category:	dropped
Size (bytes):	428822
Entropy (8bit):	5.141739584920708
Encrypted:	false
SSDEEP:	12288:HjmBzNKKure0HkBfcFZW879xhX2myXNH+Z/W13p8:8hBm
MD5:	6ADF177E37C04AFEB5C507B0C0A05EBB
SHA1:	034C04E0868F37792B6786482316EEBF31B40C47
SHA-256:	C0A3D2EDBC9F8965C184633FED2CA1FEAFF25C93372F80A63C80AB2344DBD918
SHA-512:	A4F7BF9198A6327A90BA7027E2B41D1B10B48FA34C5857CD11B78BFF377C287669AC9DD933F25AA623405930714EEDD0033497C79DCF305A6F9D7888E2AB20FC
Malicious:	false
Preview:	THIRD PARTY SOFTWARE NOTICES AND INFORMATION..Do Not Translate or Localize....This software incorporates material from third parties. Microsoft makes certain..open source code available at http://3rdpartysource.microsoft.com, or you may..send a check or money order for US $5.00, including the product name, the open..source component name, and version number, to:....Source Code Compliance Team..Microsoft Corporation..One Microsoft Way..Redmond, WA 98052..USA....Notwithstanding any other terms, you may reverse engineer this software to the..extent required to debug changes to any libraries licensed under the GNU Lesser..General Public License.......(OpenType Sanitizer)..undefined <https://github.com/khaledhosny/ots.git>..Copyright (c) 2009-2017 The OTS Authors. All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are..met:.... * Redistributions of source code must retain the above

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\Update.VisualElementsManifest.xml

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	441
Entropy (8bit):	5.112830834903654
Encrypted:	false
SSDEEP:	6:ejHyWc4subuVFWod/NDhkQwYnF4kQwYyVevZs/FhYyVevZ6CB/FP5VevZf/FeXXX:ebvyWW/meZ/evi/evMC3evQdrKQ
MD5:	4A061850DC8B7F1187B8F6CA479B8FAB
SHA1:	A6A8CDC9A81A3A054E30770C5359A1DAE007E630
SHA-256:	556D794A47D829E38DBF430ECD97AC1C9FB778A3294BA252BBB99C9F48FC290E
SHA-512:	337F2D53EB31678585534E9E192A777BB812307909165D936EF3CFF8ACB4DFB2294A77781E85D7D61AE17BE0CD8F2703938C9A7023BDF308BBF3613D0D6D050D
Malicious:	false
Preview:	<Application xmlns:xsi='http://www.w3.org/2001/XMLSchema-instance'>.. <VisualElements.. ShowNameOnSquare150x150Logo='on'.. Square150x150Logo='current\resources\assets\windows\TeamsLogo.png'.. Square70x70Logo='current\resources\assets\windows\TeamsLogoSmall.png'.. Square44x44Logo='current\resources\assets\windows\TeamsSquare44x44Logo.png'.. ForegroundText='light'.. BackgroundColor='#41479d'/>..</Application>

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	26788433
Entropy (8bit):	5.913416020828915
Encrypted:	false
SSDEEP:	98304:XtpFS4N2rhuNQDuzwr99cFOpFLtS1KJdyiUFUOUFUH+8uLNNAUugHImUJX+M4Kjk:Xko+9CgpjS0dDymHI1JXXY
MD5:	7BA6AFE1B148D09822FF4D4820BEADE8
SHA1:	CBC0578E1457B6F3F3DAA8DA3EC8161E061A59F2
SHA-256:	2DC052C546E34A034CF93A32603EA4FC5AB89895B9A17D1BF386822184BBFB73
SHA-512:	41B250A80CB8D6398DCF2E5C56A8063FD5D297409103584C2EE3CF05BF7B38B00B319DC1A0CF2ABC369BC8A6598FAFBFC545202AD5E43E1BC6EA3EA2C8ACA5A1
Malicious:	false
Preview:	................{"files":{"assets":{"files":{".gitignore":{"size":10,"offset":"0"},"12x12-available.png":{"size":439,"offset":"10"},"12x12-away.png":{"size":427,"offset":"449"},"12x12-busy.png":{"size":352,"offset":"876"},"12x12-dnd.png":{"size":379,"offset":"1228"},"12x12-reset.png":{"size":325,"offset":"1607"},"20x20-available.png":{"size":384,"offset":"1932"},"20x20-away.png":{"size":374,"offset":"2316"},"20x20-busy.png":{"size":273,"offset":"2690"},"20x20-dnd.png":{"size":337,"offset":"2963"},"arm64":{"files":{"TeamsIconSet.dll":{"size":1518968,"offset":"3300"}}},"audio":{"files":{"bop.mp3":{"size":176768,"offset":"1522268"},"bounce.mp3":{"size":116288,"offset":"1699036"},"bubbles.mp3":{"size":153728,"offset":"1815324"},"bubblesloud.mp3":{"size":520932,"offset":"1969052"},"dripdrop.mp3":{"size":136448,"offset":"2489984"},"eureka.mp3":{"size":242048,"offset":"2626432"},"flutter.mp3":{"size":155648,"offset":"2868480"},"highscore.mp3":{"size":117248,"offset":"3024128"},"meetup_ring.mp

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\electron-windows-interactive-notifications\build\Release\InteractiveNotifications.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	126024
Entropy (8bit):	7.197395351282949
Encrypted:	false
SSDEEP:	1536:Oqutwq9fhb/yk26dqwQLshkk9bWNdcAoyX9xPj36wr8LSPjC+0I/Iaz3Z33zT:OXwqBhb/yk2Gq+ikVWjdtxbbr8xIPZ3f
MD5:	0E00F05CE6EC41E01A993A7D511398A9
SHA1:	BC5AC0C0D145868FFC4A796FF6558C7DAD2B33B0
SHA-256:	37D0BB1B99B63DDC13029FFB99489F333C5B3AC360C02961BFC4DEA709CB21F9
SHA-512:	C95D2E3965BF46653AD530D76FE8B23455FE488C413972F198C390611C28709A9654C968A4A2429E71318190C509B1C2700BFCA79368F1826AFB7565310482C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........{..O..OO..OO..O.r.NK..O.r.NV..O.r.NG..O.r.NM..O ~.NI..OFb.O@..OO..O...O.s.NL..O.s.NN..O.stON..O.s.NN..ORichO..O................PE..d....O._.........." ................................................................}.....`A...........................................h...8...........<...............HN......\....^..p....................`..(...._...............................................text...$........................... ..`.rdata..@...........................@..@.data...H...........................@....pdata..............................@..@.rsrc...<...........................@..@.reloc..\...........................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\electron-windows-interactive-notifications\build\Release\notifications_bindings.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	44648
Entropy (8bit):	6.712214916246132
Encrypted:	false
SSDEEP:	768:xpb+d/5mjy53GHrw6yyxeJ7I0bJ6TRxw9zgAM9zl0do:qdBmjyGj0bJUIzgAEzS+
MD5:	9AD9449DB3AB4427E552550C2AE79D06
SHA1:	DE00AEB4E1EF868BDC00A93996C18AA0762C265F
SHA-256:	F851A541DC3A21467CCF7EB766883BB854C5AA3AE390954F473B72DF9F7E6A46
SHA-512:	3C84A71333619F656DEE7FDD05AA52568DBFC6F7122E6BC6C12CEB0F6BCD0B6185E2A31B739E3E34339DC4AC2B337179517BE98DA543D652F9C5FF6D1107962A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........q.c...0...0...0.h.0...0n..1...0n..1...0n..1...0.y.1...0n..1...0.h.1...0...0...0_..1...0_..1...0_.z0...0_..1...0Rich...0........PE..d...7.cf.........." ...'.&...6.......!....................................................`..........................................^..p....^..........<.......H....`..hN...........F..p............................C..@............@......tR..@....................text....%.......&.................. ..`.rdata...'...@...(...*..............@..@.data........p.......R..............@....pdata..H............V..............@..@.rsrc...<............Z..............@..@.reloc...............^..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\fasttext-languagedetector\build\Release\fastText-languagedetector.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	415304
Entropy (8bit):	6.458048544217013
Encrypted:	false
SSDEEP:	6144:WYFGHBEvz778o9JYH5K6VClZhYO+OLussBQrmEPIErfxFozrnygj+MdzKok:WnHZoHo5K6IlZhYnoussBLEw+pFoeEM
MD5:	ABD0269069D1775729727A927918D282
SHA1:	9C86AC6A1B90F3356439205D129B9A9A7CE9595A
SHA-256:	4AD7E6798B010880B517C717E594F9A89DB3AAFAF6BFB61182D2791049DFA6C3
SHA-512:	DB91789A658550174252E42D5722EDA36492383DFA51A171167332F13602C54A1D5F10D8D6F345346B867E737825FE4F1A28528C913FAF4FAD386AEE57341D1A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........aq..............x.......x..N....x..............?.......?.......?........x..........,..................................Rich....................PE..d.....cf.........." ...'.............c.......................................p...........`.............................................p......(....P..<.......x9......HN...`......`#..p....................%..(.......@............ ......d...@....................text............................... ..`.rdata..D.... ......................@..@.data...D8..........................@....pdata..x9.......:..................@..@_RDATA.......@......................@..@.rsrc...<....P......................@..@.reloc.......`......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@microsoft\fasttext-languagedetector\models\lid.176.ftz

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	938013
Entropy (8bit):	7.055812500667456
Encrypted:	false
SSDEEP:	12288:df3/DoSn9GZG7fXMcH+/hPiHswHZ3ZpiRhiU6q13Idv/rk5RngwNtYjutXON67e4:TnrMcH0ZHUJUeU6q5Gzkbgw40aa
MD5:	340156704BB8C8E50C4ABF35A7EC2569
SHA1:	86D1B630BA55A5040231EDA9FE24A7BEFDC411F2
SHA-256:	8F3472CFE8738A7B6099E8E999C3CBFAE0DCD15696AAC7D7738A8039DB603E83
SHA-512:	67E03B16AE3C49E310FECE12A59CD42C6BDD3A1DFBBFBF60D51650565D62CDF4CAC4B317814F9C538DAE36D0B716D51D4FAEAC9C6CB2FC9A6DD3601048ACF802
Malicious:	false
Preview:	..O/................................................d...-C...6.?....C.......~..!............</s>..&.......de...]......in..B......and...0......la...)......sa.EK!......en..........is..v.........<........der..........was..g.......und.>...........G.......die..........for......................as..........que.gR.......di..........un.._.......el..........by.c........des..s.......with..C.......le.2........nga.x;.......del.j........y..b.......et.~S.......den..,.......at..........se.....................:.k........(UTC).O........von...........#[.......from.i........da..........il.C........Ang.t........du..S.......his.R........van..........les..........na.........are..........una..........he..v...........Y.......er.~K.......al..?.......es.H9........r..........das..........im..........per.6........this.S........con..........mit..........ist....................je..m.......por..].......est..>.......als.P........ang..........zu..........los.7........have..........has...................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@msteams\package-utils\build\Release\package-utils.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	169056
Entropy (8bit):	6.733411839983078
Encrypted:	false
SSDEEP:	3072:FyLogqTXqifvBMDc/f0b9mNoJbZzMZfo4knTz:Fyozr6DTbYOJMo4G
MD5:	5E48383E5D98BF5B0F1D37AF5DBBE6ED
SHA1:	1C6E9C7B9C0B2E21EA15112FE4164F1CCCFDC706
SHA-256:	927E7CD335B88AF70D77752BDA2D83D09728EB7A81E74335099928231279AE65
SHA-512:	27DD48CE1DFFAADD6BCAA1472788ECE5842B416B5AFD01032EAAED9545DA223BAB4D49D1B3F82314EC31DA95B970EE2877BE97BCF278534A33D6319570F6A232
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............e...e...e.......e.D.d...e.D.a...e.D.f...e.D.`...e...d...e...d.*.e.u.l...e.u.e...e.u.....e.u.g...e.Rich..e.........PE..d....cf.........." ...'.x...........[....................................................`A........................................@"..`...."..........<....P.......F..`N..............p...............................@...................8...@....................text....w.......x.................. ..`.rdata...............\|..............@..@.data...h....@......................@....pdata.......P.......&..............@..@.didat.. ....p.......>..............@....rsrc...<............@..............@..@.reloc...............D..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\@skype\call-manager\build\Release\call_manager.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1023072
Entropy (8bit):	6.430832393639453
Encrypted:	false
SSDEEP:	12288:k2GBp0OpgiQtqDgrYFPAq4Tny398DN4daw1py1sX2hSim94omP:s0OpgiqqDgrYF4q4T5DNHwYkbim9+
MD5:	21CC8BAB204F1F1399D2D55AEF37E33D
SHA1:	86CA6C2BD1DA44F51AF93200E33E8A9EAE0CAB51
SHA-256:	586347E804F0B546B79E77D42AA44C9FD755E1199EE092A45BC8FCF102531080
SHA-512:	8B20BB557F7DAE6134DA338008F4042B88E9CB65B0A074AE2879DAE03C13A2A8F5017EF7408921BC86354F173AE10164DB6FC562844318497280A2A16D40867A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......../SM.N=..N=..N=..6>..N=..68.\|N=..69..N=..N=..N=..6...N=.!.9..N=.!.>..N=.!.8..N=..6<..N=..N<.*N=...4..N=...=..N=......N=...?..N=.Rich.N=.........PE..d.....cf.........." ...'............X................................................a....`..........................................m..\...\m..@.......<...........N..`N..............p.......................(....U..@...................<d..@....................text...8........................... ..`.rdata..............................@..@.data....`.......B...f..............@....pdata.............................@..@_RDATA...............2..............@..@.rsrc...<............4..............@..@.reloc...............8..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\adal34-win\build\Release\adal-win.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	116296
Entropy (8bit):	6.4420589226609595
Encrypted:	false
SSDEEP:	1536:MkcjeKhqCUx8zcCfGkvJOQH5ukwPStR38+oH23FFJou3zJZLzp:mjBhlU6wkvJ9fpZNoH4FFJz1
MD5:	915D3B689457F0A5E8B429408CE4B407
SHA1:	67250EC0CB0933E0E2A5B858C0A75083BA3BFB48
SHA-256:	A4921129631CAE9BFF46E1C99335E0541A58AC332610DCC990E78AE61E475A0D
SHA-512:	BF1F8981EF75ABD8AE59CA727EF43136FF82CD12E24CAC943389FFACAFD02C4FD46486F840AD44F9A5F887E065ED18AF85BE5C089C43FF5ED068DFD7AC7FDA67
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........BD..#..#..#..[...#.<.+..#.<....#.<.)..#.8L+..#.<./..#..[+..#..#+..#...#..#.....#.....#...(..#.Rich.#*.........................PE..d...>.cf.........." ...'.................................................................`.........................................pT..P....T..........<............x..HN..........P...p.......................(.......@....................?..@....................text............................... ..`.rdata...j.......l..................@..@.data...H....p.......X..............@....pdata...............`..............@..@.rsrc...<............p..............@..@.reloc...............t..............@..B................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\adal34-win\build\Release\adal.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1768520
Entropy (8bit):	6.312355250937054
Encrypted:	false
SSDEEP:	49152:V6d8U2Jf0wh4qpepKWb2kMHrUYPInpcATr:o6f0y56pl
MD5:	A45F31D4B23ED399F9E1A3A332878E55
SHA1:	A1F6C67CF20375262951D7F72C8E8814FD8DF4D8
SHA-256:	4A2AB20E05866F79AD788FA8D7114008241D3250FBF3EBBB8A113BAA871AB370
SHA-512:	4058F13E47B4CF6098666C05F0AC909D951804DBC3220C3A84CAB1939FEB9D401250FE98A79E72593157B49B3D7AE3CA26E25E0244598CA077E0A8BD84CB83D1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........s..;...;...;...^t..0...^t......0}..+...0}..1...0}......^t..#...^t..:...^t..&...;...U....}..1....}.......}..:....}G.:...;./.9....}..:...Rich;...........PE..d...'.^.........." ................0Y....................................... ...........`A........................................p...........,...............P.......HN.......(...+..T...................8,..(.......0............................................text............................... ..`.rdata..\D.......F..................@..@.data........@.....................@....pdata..P...........................@..@.didat..@...........................@..._RDATA..............................@..@.rsrc...............................@..@.reloc...(.........................@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keyboard-layout\build\Release\keyboard-layout-manager.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	219304
Entropy (8bit):	6.514468278752069
Encrypted:	false
SSDEEP:	3072:TTVYlCRc5IwG3mgVXDSBa6LY+5EBTRVo6ym0XuDOrTswIg:lYlCRc51A1h6aM5EvyVXuiJ3
MD5:	7E3B27C0F33B729348050DD90D9A0038
SHA1:	71370BAAE8A3FC0B32B06FB4563FE5896913134B
SHA-256:	7F8466DDDE35E149620F7F81E00F1911AF45306C7FBBF7A75E9D8E67152408D0
SHA-512:	9F0B274239C1FA453A1996DE773DF99D2ABA07ACCE2797BF4D8686F3FBEEEB597917A5838AD496B3A90341671EC463DAAC2AF0ABE662F5CD7A2541C0492C83FA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........)..z..z..z..{..z..{..z..{..z..z..zOW.{..zOW.{..zOW.{..z..{..z..z..z~T.{..z~T.{..z~T`z..z~T.{..zRich..z................PE..d.....cf.........." ...'.............5.......................................@......V.....`.........................................@...l.......<.... ..<.......$........v...0..........p........................... l..@...................t...@....................text...0........................... ..`.rdata..H...........................@..@.data...............................@....pdata..$...........................@..@_RDATA..............................@..@.rsrc...<.... ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\keytar4\build\Release\keytar.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	212616
Entropy (8bit):	6.423779726339643
Encrypted:	false
SSDEEP:	3072:tTdlimWV+f0ej9a4COU6fv7kPDLMKIiq6WTEgKx98RziLhIkm:tTfbWV7ej9a4COU6fvYXMBiqbRzid
MD5:	889AE86CE3914C05D2F5FB8D9EA7338B
SHA1:	76377C3C42CA91C5D76B588EF017C49846AA47CF
SHA-256:	2500BAE14844B123F68CE2AB72284B2FFB8734962207A4FE33315C1E0DCF3E0A
SHA-512:	426BC6B93A5D75A666D0CD94F5A4E8281DA12305EF80BBA14D80F9EFA348246E520A8E5EB2C0D7E2ADBBF66C29E4DFA45FC599E89DD324E7599A8229F6F149F9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......y..\|=.`/=.`/=.`/v.c.8.`/v.e...`/v.d.7.`/=.`/<.`/.Ud.3.`/.Uc.,.`/.Ue...`/v.a.8.`/=.a/..`/.Vi.9.`/.V`.<.`/.V./<.`/.Vb.<.`/Rich=.`/........PE..d.....cf.........." ...'............h........................................0......b6....`......................................... ...P...p...<.......<.......L........v... ..,....`..p....................c..(....[..@.......................@....................text.............................. ..`.rdata..............................@..@.data...L!..........................@....pdata..L...........................@..@_RDATA..............................@..@.rsrc...<...........................@..@.reloc..,.... ......................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\m365-browser\build\Release\m365-browser.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	538184
Entropy (8bit):	6.462414946018231
Encrypted:	false
SSDEEP:	12288:+lx2b6JweE4RFKGHkwgfWAt9V2GS2F80lvfTWJgu:+lx2bjGHTAt9V1SM80dqZ
MD5:	E0C11B972CE3181D4A3F6C7721C5A892
SHA1:	4F3DE1555E7CE58D17FA73846412BF0FD7499176
SHA-256:	9C8BD72D579C7AF20A64A7BE9668175718837E0EB518A342F3626C690D0F5E41
SHA-512:	3E16BFCB384499BDE9E7EB76ACEB824FF084B0B15D268132B49C4ED29B063F5F063908564E643CE1DAEA7238F1341C00E532A9859C1536C7EEFB8A6475DE1A20
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......T.Ue..;6..;6..;6[.87..;6[.>7..;6[.?7..;6..;6..;6. ?7..;6. 87..;6. >7_.;6[.=7..;6[.:7..;6..:6..;6.#27..;6.#;7..;6.#.6..;6.#97..;6Rich..;6........................PE..d...I.cf.........." ...'.............J.......................................P......&a....`A............................................\...\...x....0..<.......\=......HN...@...... ...p.......................(.......@............ .......{..@....................text............................... ..`.rdata...o... ...p..................@..@.data....6...........v..............@....pdata..\=.......>..................@..@.didat..(...........................@..._RDATA....... ......................@..@.rsrc...<....0......................@..@.reloc.......@......................@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\media-hid\build\Release\media-hid.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	777288
Entropy (8bit):	6.503268306446413
Encrypted:	false
SSDEEP:	12288:7PM22/qUC4iDyjVtUAW2Oe9vxAsCv133WKKYTXH:7EnVXOe9vcvZ3WKF7H
MD5:	4CC9504D56A3E9C5558222CDFDDE4C27
SHA1:	FDFEDC1007F89EA97E1261DFBBE39376870118B9
SHA-256:	149361C1E03D1F3181C083F332C437B2C0278F09220E45764712D1F5233A84F9
SHA-512:	0F83ED03EAADC63C4005A885E9BC7ABDE32FB3FB18F9C640411FEFC4201511E9B31D866EB162F594F6B609E108994CB885D4BC11547D408D6C1AC07306D98586
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.............................;.........^......^......^........................o......o......o.H..... ....o......Rich............................PE..d.....cf.........." ...'.............s...............................................K....`A............................................T...$...x.......$....P...b......HN......<.......p.......................(...@...@.......................@....................text...<........................... ..`.rdata..T...........................@..@.data....E.......*..................@....pdata...b...P...d..................@..@.didat...............p..............@..._RDATA...............r..............@..@.rsrc...$............t..............@..@.reloc..<............z..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\modern-osutils\build\Release\modern-osutils.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	462944
Entropy (8bit):	6.403965290367293
Encrypted:	false
SSDEEP:	6144:X09wIwa7YT+Pp8VPbPrRJs0XJMtAB0HWTEJ4S9tz:X0+HKPp8xbrso0TKSX
MD5:	6EDD196156D676924C4033CA061B855A
SHA1:	B9CEEABC5187F09E479724E3C1320D00A586DE93
SHA-256:	B6F55CD3570BCDC5B8984620AE0BB7A6702C6B7ADC5BE3D62CE34068F2108861
SHA-512:	AD96FDC0C05D2B8BDACEC1BEE93AE7E6F7DA1C6C84D0B1BD895C9429AA5DDDD0FE648A28F1377CDB19D8C30E243B251826768E6F96CB624193BAE8BF5AE3D2A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........3..]R..]R..]R..Ta.WR.....[R.....UR.....YR.....DR.....\R...*..TR..]R..YS.....NR.....\R.....\R.....\R..Rich]R..........PE..d...0.cf.........." ...'.6................................................................`A........................................Pa..`....a..........<........:......`N..........0...p.......................(....^..@............P.......Q..@....................text...\5.......6.................. ..`.rdata.......P...0...:..............@..@.data................j..............@....pdata...:.......<...z..............@..@.didat..............................@....rsrc...<...........................@..@.reloc..............................@..B........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\msft-wam\build\Release\wam.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	211528
Entropy (8bit):	6.44508276617275
Encrypted:	false
SSDEEP:	3072:qEDh1EpBSjWbDJ9EqIV1y/7Phvr7zQKCPzVopeAi43PQ0d0G+/znjToAoV94:qeKpYj88y/7P5/QKyRweAi43qP
MD5:	F69CE6FA71D9A7DBCA6EC32C7A6A2C6D
SHA1:	F2D56FC74F7907C0F830ED67F6B3C1A7474CC215
SHA-256:	6F50D9A7740E46D7BF589F475EACB86583CAC226910D6987D83C9D03905E47F4
SHA-512:	5154A8256DE3D1C5D471E6D3F96E03EC0A58CBA493511D4E5FBE654C56D88D7A6792CFDAAD50FB33CB2B2FCAD1C8814D311C0FA0B1A12E494F3A2BDB3D4AA1DF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......4q5.p.[.p.[.p.[..._.x.[...X.u.[...Z.x.[.....y.[.yh.\|.[...^.o.[.;hZ.u.[.p.Z...[...R.\|.[...[.q.[.....q.[.p..q.[...Y.q.[.Richp.[.........PE..d...T.cf.........." ...'. ..........T........................................ ......J.....`............................................L...<...................l.......HN......x....I..p....................J..(....6..@............0......x...@....................text............ .................. ..`.rdata.......0.......$..............@..@.data....(....... ..................@....pdata..l...........................@..@.rsrc...............................@..@.reloc..x...........................@..B........................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\native-utils\build\Release\native-utils.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	239688
Entropy (8bit):	6.469155909125638
Encrypted:	false
SSDEEP:	3072:Yt48gNLgbvzY0b9f0hv5Q9IazJZBvwg0MELTvYwswm8hiIc022FwaPD5mbVXz1:YttyOv2BRazJHvwg0M6zkovD5mBB
MD5:	CF180450849CC1A04536BEE1FD67D9CE
SHA1:	BB1D7FCCBD3F81FAE752721ABD90F0DA67AE3BB7
SHA-256:	85B28031A2BECA88DB432769BB364CEF5E8E6D0861F82E3F68C5A754634C57EF
SHA-512:	FB90C161BF4799E329A858C4520E84FA11F6350CDB1346E099CEF56F6C8E8CC74F0C3F4998B96A16D0FF965CEBF15A57EE73C7525DF328D49BEF796AF77528CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........-...CA..CA..CA...A..CAK!B@..CAK!.A..CAK!G@..CAK!@@..CAK!F@..CA..G@..CA..F@..CA..B@..CA..BA..CAz"J@..CAz"C@..CAz".A..CAz"A@..CARich..CA........PE..d...5.cf.........." ...'.T..........................................................1.....`A........................................P...\...............<....`...!...Z..HN......$.......p.......................(.......@............p..P.......@....................text....R.......T.................. ..`.rdata..2....p.......X..............@..@.data........@....... ..............@....pdata...!...`..."...,..............@..@.didat...............N..............@....rsrc...<............P..............@..@.reloc..$............T..............@..B........................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\office-int-win\build\Release\office-int-win.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	670304
Entropy (8bit):	6.447230459719399
Encrypted:	false
SSDEEP:	12288:M5CVHpXN1H3qC5Wop70uEOzfgt8LVc01LqV/yWlq9y06F:/hpXNUCPgx01LGBUcF
MD5:	A9A915A183ABEEBA33310B6312F74F5D
SHA1:	D90A19A5F3FBE77D2E935F9B2FDA7B18BD24B861
SHA-256:	DA22D068CA47C439FCF39D0473E58A9477B32BC9BC8273DF6AA134667A3AB246
SHA-512:	D134D591B5679E17CE97C8FB2A67CF7D22308E7CECA7F8879C49A8B3688FE672F11012DD75331E5BAF8DFFFF542D51F72F30321C3C47B9A7D266E2DE7810908F
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........x..+..+..+.....+...Z.+..+..+0e...+0e...+0e...+.....+.....+.....+..+..+.f...+.f...+.fS+..+.f.*..+Rich..+........................PE..d.....cf.........." ...'.h...........W.......................................`...... .....`A.........................................M..\...\M.......0..<........[......`N...@..\|...$...p.......................(...PW..@...............h...HC..@....................text....f.......h.................. ..`.rdata..4............l..............@..@.data....A...`...$...L..............@....pdata...[.......\...p..............@..@.didat..............................@..._RDATA....... ......................@..@.rsrc...<....0......................@..@.reloc..\|....@......................@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\oneauth\lib\oneauth.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	modified
Size (bytes):	3956808
Entropy (8bit):	6.636371659230467
Encrypted:	false
SSDEEP:	49152:cf6Ez+jmQkut5TT354ZSv+JJdSY62yGVUxlG59WgDDhXsMaaXsY3nzh4ZltON591:S+IH3nzh4Zm4Uhc6HW54
MD5:	53E41EBB544200D42EE6B9BA950CFE40
SHA1:	2C06EBCD7E9299CA98A3C1144439308DD3E2583D
SHA-256:	282C7294E7227AB6BC0841BE0F64734088E3CAEF9BF4FF8DDBD525FC05F0C058
SHA-512:	CABC06E6FB7046C6D604C02F4C1829D04C29C6F3E4149DEB22F9B6E60CCD1A4309770B15D0F2923483EAEED193F68561F98ACE6853EA149687060A64DDF185FA
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......\NKC./%../%../%.}I&../%.}I ../%.~@.../%.JZ!../%.JZ&../%.}I!.;/%.}I#../%..W.../%.JZ .s/%.}I$../%../$...%..Z,.\|.%..Z%../%..Z.../%..Z'../%.Rich./%.........................PE..d......d.........." ......$...................................................<.......=...`A..........................................6.T.....6.,.... <.<.....8.......<.HN...0<..s..\|G1.p....................H1.(... .$.8.............$.....h.5......................text.....$.......$................. ..`.rdata.......$.......$.............@..@.data........06..\....6.............@....pdata........8......p8.............@..@.didat..@.....;......P;.............@..._RDATA........;......T;.............@..@.msvcjmc.C....;..D...V;.............@....rsrc...<.... <.......;.............@..@.reloc...s...0<..t....;.............@..B................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\registry-utils\build\Release\registry-utils.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	209000
Entropy (8bit):	6.395632822724759
Encrypted:	false
SSDEEP:	3072:Y4cgmVTzfyJPrALAnBdxe1IrwqyXxkJXkNFmsfp/ysXe:HcTErA0Bdxe1IrwqmklCFxh/y1
MD5:	0913E3C3B788885E7F19BEBDB247F869
SHA1:	BDB04897707109931CCE43733FCDB41606DBC307
SHA-256:	A5AAC1F3BC961D4B735BC6C27B5077DBEBDE53BDC9F455A6CF678FC04BBE15A8
SHA-512:	F21323BA6F7BFB0D51A962A056593D0DCBF4440432B3E40845D3A872FC81EE162848296992E90F8CB467A10BEB245C4C4722D8C9D57E6EF975D8AB8D42316156
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......]k.m...>...>...>.r.>...>..?...>..?...>..?...>..?...>Rr.?...>...>...>.?...>.?...>.f>...>.?...>Rich...>........PE..d.....cf.........." ...'............0........................................@.......?....`A........................................p...`........... ..<...............hN...0..t...0m..p...........................`*..@............ ......`...@....................text............................... ..`.rdata....... ......................@..@.data...............................@....pdata..............................@..@.didat..............................@....rsrc...<.... ......................@..@.reloc..t....0......................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RTMPLTFM.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18424904
Entropy (8bit):	6.695782211674845
Encrypted:	false
SSDEEP:	196608:yWo2dhpJedBkRZHYj8DnpO9eGQhu1nCPeeV:yXMhpJeqZbKUuo2eV
MD5:	5A11D499926DAD902004066ABA379DBA
SHA1:	7A455E39E34C1D7F3CB7057A22FE25B655D3D4F3
SHA-256:	DD0034AD38F2C91C79A5FCE6C8B92E17B58279A3655FCBD0ACB216D4D9CBA7CC
SHA-512:	118AA9083F9B1CDA7008CDBBC0A43E936C2B99FBEA7B83FC17A9E92B1775C634AF80E968152FBD992D367F3226BB8DFD77BDEC587930FDA076C12F07C4B26C51
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........'.F..F..F..>..F...:..F...:..F...:..F...:..F...>..F...:...F...:..F...:..UE...>..F...:..F..F..nE...:.. E...:..F...:v.F...:..F..Rich.F..........PE..d......e.........." ..."......H......k....................................................`A........................................`...@.......................x.......HN.......d...o..T....................p..(...@n..@............................................text...t........................... ..`RT_CODE............................. ..`.rdata....2.......2.................@..@.data...x........n..................@....pdata..x...........................@..@_RDATA...V.......X..................@..@.rsrc................j..............@..@.reloc...d.......f...p..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmCodecs.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7725560
Entropy (8bit):	6.724437099114289
Encrypted:	false
SSDEEP:	49152:77xd5NS4aGlDruAZs61s1s1n1zSUZaY+uqGJyshAczLQJp3FIDBXPBWbBGy+LxLu:79fDrvNjqsacICWMqOTWP9X
MD5:	D41CA1F4204278C99AC820DD3A191EE4
SHA1:	8AAB9D89BCF6D55FB0DB08AA94D2E47B9965ABE2
SHA-256:	1EACF3F2EF79A27EBA9775BA8AC7D3C14D08A5968CE30631CC102731C9C4E4D5
SHA-512:	CF662EE236E388859F4C28520C1CA7B7B8BDDD1ADC93EFDC3A82992D405D2E2B9425589E189DE6FEEF3DC2C396EC4F77B3591257149ADC5E91695BFD9C773376
Malicious:	false
Preview:	MZ......................@...................................@...........!..L.!This program cannot be run in DOS mode....$........J..+...+...+...S;..+..WU..+..W...+..W...+..W...+..S...+..S...+..W...+...W...+...W...+...+...+...W...+...+..(...W...+...W..*...W...+...WW..+...W...+..Rich.+..........................PE..d......e.........." ..."..P...$...............................................}......pv...`A........................................`.o.....h!o.......}......@z.,.....u..M... }.T...@.f.8....................)g.(... .[.@.............P.....(.o......................text.....P.......P................. ..`.rodata.......P.......P............. ..`.rdata........P.......P.............@..@.data...Px....o.......o.............@....pdata..,....@z......Hr.............@..@.didat..X.....}.......u.............@....rsrc.........}.......u.............@..@.reloc..T.... }.......u.............@..B................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmControl.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	156232
Entropy (8bit):	6.317364255294539
Encrypted:	false
SSDEEP:	3072:v2Gi6T8tXl0hQrvVwGtmF4xS6g6KohB5msdWnwl:v7i6T8hl0W67C4+hB53r
MD5:	1435E71DB7E2DDB9CB337B9387D3C30D
SHA1:	2540EE1682EF6EDE924F80CDDBCFF779BACD3C83
SHA-256:	589652A9730FF79FE3566DA251FFC30351C5EEF2D4719D4DD43FEBBBC67F9FC0
SHA-512:	C15D427517776A7A0FD24C28DC428FF5D6B54708610F1A643E764BDC070D997EAA9ADDBFB98E4A9F3FA80B6D2483BF72F0517C72AADA65ABE7C078F753301451
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Srp..............k......Xo......Xo......Xo......\k......Xo......\k.......o...............o.......o.......o..............o......Rich....................PE..d...B..e.........." ...".............*.......................................P.......@....`A...................................................T....0...........+......HN...@..P...p...T.......................(...0...@............@...............................text....,.......................... ..`.rdata..\....@.......2..............@..@.data...............................@....pdata...+.......,..................@..@.rsrc........0......................@..@.reloc..P....@......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmMediaManager.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1674824
Entropy (8bit):	6.5037792513144534
Encrypted:	false
SSDEEP:	24576:Q9VoFeRVw0cpjF2+wBkwknB1kqCiK/3OqKdF1XkZaSsAdR2eVHWMYdb03G8hCG:QnOeRQckj1jBK/lcBkddsQWjb
MD5:	58EFEB744C616AB7124E20C096B3EE2B
SHA1:	1FD93EA6B3B5A510582C790A5806F8A1CA6555BD
SHA-256:	AD0A3BA1E1FCA395006C449484A61C4555AA8B10FCE97F64391CCC0D5884EB6B
SHA-512:	9BD38F65A811E964B5A3BDDEB126D9E43C4EE55500D6358E170FECD31D7F3FE929141E5A152386F23AC7125C1582CEFE9FBE70BC3EE64BF56E1104159E0EDB72
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$............h...h...h.......h.......h.......h.......h.......h..n....h..n....h.......h..n....h...h...i..n....h..n....h..n.d..h..n....h..Rich.h..........................PE..d......e.........." ...".....2.......r...............................................?....`A............................................4......T....P...............@..HN...`..l"...Y..T....................Z..(...pX..@............ ...............................text...~........................... ..`.rdata..v.... ......................@..@.data..............................@....pdata...............P..............@..@.rsrc........P......................@..@.reloc..l"...`...$..................@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\RtmPal.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1095752
Entropy (8bit):	6.402891372884053
Encrypted:	false
SSDEEP:	12288:Rg9sEotLPQXtYkhGFCzqzaP/VpuFSQjS27Yiq+5cB3w0LRwcY2s3Pjv2gGZK+1fm:RgaratYkwrza3eF/7jcB3wuRLYLuN1u
MD5:	5867F3AB0BF6F44B2B911E2F0AE1A67D
SHA1:	34CB14FD1FFB9F3B2052FFB900ADA0D8F643DA18
SHA-256:	67CA747D2A57D8157CF4F3BCE95BEC502294C4B3CA47593C96C22B34B566C4E4
SHA-512:	F174E43E4FCC8C5FD60ACC1AC9C2A2C00CDB8296EAC2B5BD05223FC263B00B982712DE496286D4DFB2E26FD329DBCFFF253F01B43886D5ABEEDE48C4BF5758A2
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......z.o.>...>...>...7...0...q...6...q...8...q...8...u...8...u...<...u...%.......a...q...........<...>..........?.......?.......?.......?.......?...Rich>...........PE..d......e.........." ...".....P.......................................................y....`A.........................................'..4...DU...............@..\|G...j..HN..........p...T.......................(....y..@............0..(....".......................text............................... ..`.rdata.. o...0...p..................@..@.data............t..................@....pdata..\|G...@...H..................@..@.didat...............F..............@...RtcPal_HA............H..............@....rsrc................J..............@..@.reloc...............P..............@..B................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\SlimCV.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	2420808
Entropy (8bit):	6.69324004678105
Encrypted:	false
SSDEEP:	49152:uI+IZ6ViU6kPU6dkDkkhlJ2DsFdHGfVsYiqX7oCVvFZ:0MHJZAvP
MD5:	1B6EE0B5BD4BDB86601CA10442D17600
SHA1:	4F968BDEA8DC8040002A2CD28C761826EA9F70C0
SHA-256:	95132EA656F387393EFF325C0688A471C40E7DB35511BC9B142FBB62510AA42B
SHA-512:	98D34D549F55AA198258A0BCCBF259C5C9837359F67C359FF2C27A6981150A226330345BA27C23521E7CD5E7D9778D143E21A1105765EB94E585D89F282C13A2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........a.2.2.2...2...2...3.2..3.2..3...2..3.2'.3.2..3..2...3.2.2...2...3.2'.3...2'.3.2'.~2.2'.3.2Rich.2................PE..d...D^.e.........." ...".....................................................P%.......%...`A........................................ @"..~...".,....0%.......#.L.....$.HN...@%.8...,T .T....................T .(...`R .@...............p....7"......................text............................... ..`.rdata..N9.......:..................@..@.data.........".......".............@....pdata..L.....#......t#.............@..@.didat........$......\$.............@..._RDATA...3....$..4...^$.............@..@.rsrc........0%.......$.............@..@.reloc..8....@%.......$.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\cm.slim

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	44012
Entropy (8bit):	7.397917550582591
Encrypted:	false
SSDEEP:	768:pxIG1ui6Hb+MJpYGVMcfDjASGzjt4EnshZAmNKRJZH:pmTHb+MJaGicfX3GnqLhZAL7
MD5:	84647C35B58FF5EFD78829444A3902C2
SHA1:	9D0621898A95A518D31164B57590FB392E2E98BA
SHA-256:	A42ECA02A421086C26C8FECF940BE8D29DF4DCAF16B4E642C764A9D485069743
SHA-512:	A38E6F6B472ADC8CF76CBDE72D9618FE7D02C7F942AE226C4778B8D5D2FCF30297198CBE406840A13DF3C9E7C0B1031454C6F2D25FA2BDC3B23920E0835EDB52
Malicious:	false
Preview:	SLIM_MODEL_1_5_06...................................................................................0............D&...P...E.GS...\..F~...F."8....v....D\|B.B.z.#..<d.....6,9.I.5..A.."=......D&.D..sD.........A.B.;.B).PB.B .CBB/..B.AgBIA8............................................................................D............................................................................x2.29-v2.0.&.,.'$..>.:V4......%:.......W...\....%.?7\|..8....6)9.8.:.",...''\.k.......8T4...5.1S .Y).R(.<..9.i;.....6...-;,8..,y..!>.O...o.J.(7.>....@?..8.7.4_..4.1Z#..D*...l.P .....xT\|......n....6..7.<.5..........%.~.-._.5..4b.:9A<....3b1.1.-M1X->).,..(c....%.>..F).$.(........_/..i6.=.....;i.n.P..s<..:a8............................................................................D........................@....................................................-k.?..9&2.6.6.$.398U...'.P.o-]...`...)...919.]5F85.8.=%&%..s..........2....:.U.....T..0./.8/...../ .X8.-.&..!8b'[.y#.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\onnxruntime.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8396360
Entropy (8bit):	6.525745326034534
Encrypted:	false
SSDEEP:	98304:mAkPI8o58bQMzVdxmvcbXKbRvBndGkFYbrjb4:3kPjXdxmEbXKbRvBndB
MD5:	A826D0980E3AC85E176B54D1F3EEB583
SHA1:	1FEA41EA0DA663F790497D8884AF28431B6F051D
SHA-256:	E3D965CD0D579E7AD4C9D85E9A4C5699830E18EF00F4C4E422590F4117EABE97
SHA-512:	243C444D576321C2A4925927C33551B92A6B1DCCF85E3DC35D34A45B6DD6A0663C3815878B00712A40D2973647F8261C7C6BBB33CBF35688C7DD36037653CA5D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......pOBN4.,.4.,.4.,.f[(.<.,.f[/.8.,.f[)...,.f[-.2.,.RA..6.,.=V....,.4.-../,..[/...,..[%../,..[,.5.,..[..5.,.4...5.,..[..5.,.Rich4.,.........................PE..d....,Sc.........." ......i.."........d......................................0............`A.........................................z.....x.z..............0\|..l......HN.......l....r.p.....................r.(.....r.8.............i.8............................text...;.i.......i................. ..`.rdata... ....i.."....i.............@..@.data...H?....z.......z.............@....pdata...l...0\|..n....{.............@..@_RDATA...............R..............@..@.rsrc................\..............@..@.reloc...l.......n...b..............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\psm.slim

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	371494
Entropy (8bit):	7.465111165899667
Encrypted:	false
SSDEEP:	6144:lq3vuCqK6Xny+jFV5m5X/j25j9emIcdVkJr3iixidtWwwV1gUkxCWNVX6LXyb7Vs:03H6Xy+P+XL2ICvktvxidtWwwVqxxChV
MD5:	35D7B238ECEDECF367A343FDACE53AB0
SHA1:	66D9CC55286A1082AFA2BC0CB45D57B038FD85D2
SHA-256:	0C5BED64654D7B19236E9953EE4C85122F6D3B090C8FD28818636E885806007D
SHA-512:	CAC1D0AAB7B18CCC12FC7AEC8C7D3A1DF727735E88F1B8FECA08D4E69B94D5D1194AE11F8EBF61298B6FE02AA3A838DBD13EC7997705B7B910D677A9B2FC7912
Malicious:	false
Preview:	SLIM_MODEL_1_5_0B.......`............................... ....................................................!...k.... $v..#..0.... .h.).A...1......"...........!.1...........f......4.8.5.....2.....5.6G3......s...6..6.6%1..D.@......"Q$6.C..!.'..Z.=.....9.~.8.......(c)>V(.'2).&..".&n!.$K..........5F1#.4.,t u5p-.+.4F4\3N$..g....?..4.2.1.&.,&.....3.0V2N(..x.../.?......$.S!.$%..#t ..J.^...D.&).1e5.,d...;...K%.0.4{6.0.......u-.4t6.1...P....$.$!.j .4}4..3..l.c(t..+.%..K.=..........s...X8P.(4.8./.3.8..K...g..,.., ..O-V.o.%.S........ ..\|.b...Y.....M"y.....&.:..j.w.m.7.3............K......... ...C.............#.........=.\|...........\|..(W.2!.5Y5_..'.&.(....I.o&b'...)>.. ....i..)6(.%Z,M.T...!....."............8.8.5.1./.0.f...W..L...........X...6...+....P T.D.[.....~...&..1.1;..8Z8+..(.(..................-.1t-n1'3W.k...](.e.......-.....$....t.......P.g.K.....N..$.......%..'. ~-:-......$E(.$4#.-.,....9...i............K..+....J.......*. ....1..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\qm.slim

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	370220
Entropy (8bit):	7.496118478384408
Encrypted:	false
SSDEEP:	6144:QD64Ijr5gYLV+WwZ5YFQe35+Q5sCkC0hSfw2zeKugZHxOCyemUAQVnJT+PJ9:E6466YLvfQeJcehzeTOHrffAQVJT
MD5:	95FF8628CD563FB2AC23E4778FF1188B
SHA1:	C54C2DE94DF05BC24E7EE2F4A1679D5004450A01
SHA-256:	083A72A09101C895C73418EF829B5AB6B97B412322BC9C165342717F376D1D2A
SHA-512:	CDEC378F1A67C7DEB99C41EF05D2C439B690964341EAB825055741C0888551D6FB7DC91817700E2A1F7764C618ED6A21DFBA15FC4C8AFED848CB7B9933314861
Malicious:	false
Preview:	SLIM_MODEL_2_0_0B...............................................................................................m...C,R.I..&e ././i....,I.3..%"../.2q....)#...o..(+0.0.Q.X........'N.......-,..+..)Q.o.....}...U...'..(.%..X.d...p.......'...0.,.3'-.4}6.3.5d5....b....-.0C..(.,.,#-c$k+`-.&...#c.I..#..`....!'...?.....v....T.Q#?....).W.v....).'.-.1p"X1.(..F(1-8.<0.1s...B.f...."(..-....5.o...Z.....f!t-./.)./&0.%K.&.....w.....m..F.. .-./2....0.(.....)3..-....-&...T... (.09..60=.L.=.?.1)..%.(l+.&.!.'."...!.......0.S)..!\|).+L'!#.$...,.,.(..v..#.-N(..h.]......+S)...(..............:.m.R..0.-P-.0@..%M.{...O/..,.....(......-..).,...~.O..#..y..$<&O...-!. q#.$...$.(."...-!&'.#^..$.'. ...!}!..a0.3/.[..,.......0.2..7-.......0R2...8,:...{...>.3...^.[..........!..s....z..".m-.(..X..$.)d&...1.1p.D.T0.0J2.2.4d......r...j.K..58?9.5.-.4.2.(./O3.......y...7(9.._....!b!..".\.5'...2.-\|#./.)..b(..0a.T.61g..%.I/...%...@,M.#).d,..h...P..0....G.Q.4.........)...&.&@.2...

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\sharing-indicator.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	131680
Entropy (8bit):	6.348796146121421
Encrypted:	false
SSDEEP:	3072:fE90Z0CTyulp54LSSSSSSSSSSSSSiila1KsZg8YrafIrmn4jyFIkR:8OTyulj0i81KsZgdWAi4Mn
MD5:	29D6DD27DE95FDE8FDAEB46A7487E5F9
SHA1:	377F184527A774BA9B527113749C46BDB23FCA97
SHA-256:	7D52F47E14A468BB2F61E50E5A1A3F2E12AEDDA457BC29BFB7E13A2891F19328
SHA-512:	16BB78ACEEA0DAE5D0F82B2D01F6AC4C0D255B1C4E0E78F6FDE166FA7B3AE3E30DE88FB71FF1178520C2C117D5783E80EC6C69D14E61F913ECB7F0AB7882D6F3
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......g...#..^#..^#..^*.\|^%..^.._"..^l.._+..^l.._'..^l.._...^.._3..^l.._%..^.._&..^#..^...^.._,..^.._"..^..^"..^#.x^"..^.._"..^Rich#..^........................PE..d....K.e.........." ..."............ ................................................D....`A........................................ps......Ty..@.......................`N..........P'..p....................(..(.......@....................b..@....................text...N........................... ..`.rdata..p...........................@..@.data...x...........................@....pdata..............................@..@.didat..............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\skypert.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	5052488
Entropy (8bit):	6.661676381475456
Encrypted:	false
SSDEEP:	49152:+IU6iLLmqCa0CJpyLnIRFVRKw1ANjHd8bzvvIcA670GDD2Y2OSm1oTfN/2erTnQE:J+gg7/ZOOjWfNZo9w8Jz1R5ZEyy
MD5:	EC16915BED8B29155387485301D7A6D5
SHA1:	C4DC1DFE576B33C8442B1B59F547391646D86377
SHA-256:	D641ED726C03D7C11CE46AC62A8F404B5FF4AC7C6CA8073CC7BF70823FCEC525
SHA-512:	6FC1F96154A1812BC07C3FBB3039B3FE990D4D3C361706D1B2DB481F09E7C21907A4F8CC9012D0A837D6A02888A4150EEA9B01F470173E8389D20EDAB66A7D76
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......W*$9.KJj.KJj.KJj.3.j.KJj\7Nk.KJj\7Ik.KJj\7Ok:KJj\7Kk.KJj.KJj.KJjX3Nk.KJjX3Kk.KJj.KKj2IJj.7Ik.KJj.7NkNIJj.7Ok.JJj.7Jk.KJj.7.j.KJj.7Hk.KJjRich.KJj........PE..d...#].e.........." ..."..6...........5......................................@M.......N...`A..........................................F.......H.X.....L......@J.p<....L.HN....L.....p.C.T.....................C.(...0.C.@.............6.p............................text...l.6.......6................. ..`.rdata..&N....6..P....6.............@..@.data........0I......$I.............@....pdata..p<...@J..>....I.............@..@.rsrc.........L......"L.............@..@.reloc........L......&L.............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\slimcore.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	12495432
Entropy (8bit):	6.49930524660506
Encrypted:	false
SSDEEP:	49152:e4tP1/fpZyxGQjVmrql25Ihn/wVCZ99ZLrkuf7bcQz0fmVherEcxNZR8hYZErKtS:dt/cbrkufXVQJF8bCdZ+smM9rZ6PwDil
MD5:	11B4F50B216114B10E3F9923D4978411
SHA1:	23775034AEA319825276E8017084AD8C0331B34D
SHA-256:	2CE856F4C3121E19A18F563161B9AB22CA96C422EB67B0F75E79260F3429974D
SHA-512:	B4EF74A87CF2D8EE237FDF28EE392007C31AC67207BE4C9F911EF6CAE1661CBA9B868EDE8F0019B0B2775D0C42040341F7ECE7426E4F9EBF5C714B42503CCABF
Malicious:	false
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$......................{.....................................................................................................................................Rich...........................PE..d...;L.e.........." ...".T..........................................................y6....`A........................................p`......Df..0....P..........H....\..HN...`...L..@..p......................(...0...@............p.......A.......................text....R.......T.................. ..`.rdata..F."..p...."..X..............@..@.data...`N...@...F..................@....pdata..H............`..............@..@.didat..(....@......................@....rsrc........P......................@..@.reloc...L...`...N..................@..B........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\ssScreenVVS2.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	399432
Entropy (8bit):	6.003975154048508
Encrypted:	false
SSDEEP:	6144:KoESpgWXA/T52CaRr9ptv9YutpVzfBxqF7pRKX0u:TpgWXWT52bR9ptveSXx0RKE
MD5:	32D2957247B5236C198F030BA7C1A500
SHA1:	F6341CF35F458269F83AEEB3A7E2D9C25C7798B9
SHA-256:	AEC2BCE8521F4F1FC10BE44C00CAD79ADD515715D5C3240C62F04A0B49234EE8
SHA-512:	957C82CF12EB2C3A70210260FA5D79A6E4F2BC09E18CBF987AA47B1E91EDC7BD506E4A0C24EBADD08EB3D051D1F80FBE48C0BFBE4A06D095F13F997A240A7E68
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........G..&...&...&...^...&...^ ..&...Z...&...Z...&...Z...&...Z...&...^...&...^...&..[Z...&..[Z...&...&..l&..[Z...&..[Z...&..[ZL..&..[Z...&..Rich.&..........................PE..d...G..e.........." ..."..................................................... ............`A.........................................A..X....B...................?......HN..........@...T.......................(...@...@............0.......?..`....................text............................... ..`.rdata...2...0...4..................@..@.data....8...p...(...P..............@....pdata...?.......@...x..............@..@.didat..X...........................@....rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\app.asar.unpacked\node_modules\slimcore\bin\vdibridge.node

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	397384
Entropy (8bit):	6.533857841786125
Encrypted:	false
SSDEEP:	6144:N1SC3x480+QJHXTRx7Uke1XA80eHrm+ATGQtRFTTAOIQWvUSEClxkX8VtY:N1X4L+QJH9hUkCgVTddTAOIQWMvixDY
MD5:	9667A9223D9E30711CB1B9C28147A15C
SHA1:	248106C66E15F5F48A9E20ABDBC11A841BBC7208
SHA-256:	03EADF5A5F63B946C56AD174358A04EB70C7632D470D6E670C555AC92A0B64C7
SHA-512:	82EBC4093CEE3925D3457A7EC36F66E86B3E79191951F844F7A64A42ABA75F16C5AB6CBACCC6FAB6617AAD5F3C10278BCCE6A89FA07DBCD04106507E140F9E41
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$......._..=...n...n...n..en...nP..o...nT..o...nT..o...nT..o...n..o...nP..o...nP..o...n...n...nT..o...n..o...n..o...n..n...n..o...nRich...n................PE..d....RAe.........." ...".F...x.......+..............................................m.....`A.........................................B.......H..................P1......HN......H...@...T.......................(.......@............`..p....4..`....................text...jD.......F.................. ..`.rdata..h....`... ...J..............@..@.data................j..............@....pdata..P1.......2..................@..@.didat..............................@....rsrc...............................@..@.reloc..H...........................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\12x12-available.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	439
Entropy (8bit):	7.012052266568622
Encrypted:	false
SSDEEP:	12:6v/7DR8/kAPZewT1Lm7OtbBxordTcMV7v:+RSol7ktSrdTHV7v
MD5:	2FCC0EB70D8998EEDDCA241B049FD140
SHA1:	F6699C636B0BF54A773F9DCA111577EDC49436CE
SHA-256:	C22536DC7EEB83EB0A1E509A9F0B2092982302A02982AA0DA23CE54E04B28903
SHA-512:	3C4EA183D28E13089CE913A3FC93E29D22655F51898639BEC535774616E4BF1B249E5D16E1C2D60B5545964A83095F4ED94BF734BAA7E5343C18C20AAD9077A8
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....sRGB.........gAMA......a.....pHYs..........d_.....tEXtSoftware.paint.net 4.0.21. i....'IDAT(Sc...g.X.w2...]...w1......w0.5.b..]...W\....(......k...^_....5..b0n..p.~?..H.,l.@.c....=lp>PS3C.z$7#.....\......X...7......_}).l...k.......py.F.......?.....P...N........tPN..........v7T1..b`h.d..3.`.n...{y1L.a..R.P..9..%Q.N....=X........H..36.@.R\.4...Fpl.b..).p.......f.3.&..30....,N..0.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\12x12-away.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	427
Entropy (8bit):	7.069527276942106
Encrypted:	false
SSDEEP:	12:6v/7DR8/kAW2GsnURNgdDkiCf2PwA2Tyc/Bc:+RSuipLf4AeyGc
MD5:	E48D99F780CD086B94C393C375718A12
SHA1:	2770F1340AEC6C222EC9E73A975006B70AFB502F
SHA-256:	7814D23CF58D38087A09744D1ABBD75A418FE5CEDDA74561A65BB7F35FD451EA
SHA-512:	9287022DA336BC7512377AA682D3AD85F9EEBCB7C63E2B0D12A5FD2DD83E581F5A720B3021520A635BEB95F8629A7EE65027D7D554F125E2E7155673E742C748
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....sRGB.........gAMA......a.....pHYs..........d_.....tEXtSoftware.paint.net 4.0.21. i.....IDAT(S}Q.JCA.<....hcl..!...~@..._Haea+..[;.?.`a...U.0.J.I..6..;.ss...da.33.3$./.Mt.I..[.....I.c..\{......&._2.5..C..?...S....^.n...>\4u...Q...6.....K....R.4~R>s:\a..wG.8\e.,..+@2..~......w.q0l..~..M?..w.\|.sIC....."..?......MU%)E...Bp.g"]w.;[$.J)r...)D..m..fms.R....P2K..y&&..E@...l"....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\12x12-busy.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	352
Entropy (8bit):	6.798568230262349
Encrypted:	false
SSDEEP:	6:6v/lhPIcR8R/UDTljg7+BXakzVAVgsDc2KEZwe1hTytm4UTHHERFsWxm+G8glljp:6v/7DR8/kA+BKkzigP2Kdqc0YFvxdgl7
MD5:	24AEEFE6F08022CDC17772BB8A2D9E3C
SHA1:	F9CCBEAFE11B66D0967626C926664E6F01EF5627
SHA-256:	C77DC96FA225213B7CD0C647AAAF657F343C8371D6809BEF7A2A07BC17AF977F
SHA-512:	F7E62DB0AAC633CC258FEB1150C6534296DA822B6A1C9B07BBA0D9A390320F99D9E361D11404EC246EB6435CF2B2F029B01879E65A5F7AF31BD75598652ABFA0
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....sRGB.........gAMA......a.....pHYs..........d_.....tEXtSoftware.paint.net 4.0.21. i.....IDAT(Sc..3..G.......:...(....>...0.N.q.C.U...p...*...).......{=.....d\|.a.W..~~}...3.).....53.............>L..P.a.......d..36Il...n).(R..U...]...B.O...1.b.(...gt.0.R\|.G[.?..#8.A1...P8.M{.W.t3.. .!....\..@n.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\12x12-dnd.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	379
Entropy (8bit):	6.9421420243208125
Encrypted:	false
SSDEEP:	6:6v/lhPIcR8R/UDTljg7WhArakzVAVgsDc2KEZwe166Kd+hNz5cxVdZXPs+UlXwQB:6v/7DR8/kAWhA2kzigP2Kdqsd+J63Z/m
MD5:	088D824C221FF7626AE857B2E2811AF3
SHA1:	211BDD35D03F852A601FB4C8F0B591EA39CE4C92
SHA-256:	6E138C70BAB115DB6A18B406AC562D5C960FFBE24805D3E355F98A88C0D11950
SHA-512:	008ECCAF5AA48FADB353E067F3B56729BB1CB439264CB6806169F2AC7C0CD6088071BCDD4381C7DB39F0D95FEBC9EC1CD4C84154374F4FB6022DD28E8DDC3CB3
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....sRGB.........gAMA......a.....pHYs..........d_.....tEXtSoftware.paint.net 4.0.21. i.....IDAT(Sc..3..G.......:...(....>...0.N.q.C.U...p...*...).......{=.....d\|.a.W..~~}...3.).....53...........Y.~e.._......(.P4.J.....i.\|50.U.(....#\|.7.@.M..>.[....h8cU..@W......Bf\|.........]!.............mP.."...@.......r..d.b....k.d........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\12x12-reset.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 12 x 12, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	325
Entropy (8bit):	6.835643852475039
Encrypted:	false
SSDEEP:	6:6v/lhPIcWCCtdoRg7sL0Kdxu+Nbfu2/dx5qb6XC9/XvjlNk6Bysp:6v/7DWjtSU20+uAbfFdx51eXb/x
MD5:	8C713061F59928DB085FA718A5222B71
SHA1:	09FB3D0BCF8D8FD7B76BA62FBE384EBCE82E44B6
SHA-256:	7A91FDE9E5F92F82CA46D6FBC05E35C018730614CE9EE99E32F9CD1FDFB87777
SHA-512:	50190AFDBF80A6587F2CFC50678265AAAE4F9D996DB2B799876DB327BCDDD70FFCC97D4F8A1EA76DE8935BDD236CA9871ADCFA5CB30FEF9CDBF40CAC03A697A4
Malicious:	false
Preview:	.PNG........IHDR.............Vu\.....gAMA......a.....pHYs...........k.....tEXtSoftware.paint.net 4.0.21. i.....IDAT(S}.=..Q....O!:.X....uT6`.DM...@b#.....;qe..K.L.{b....Z....@..m..@........*X........:H.`....,lb.....Q._7..K.qD._.!5l`{w.-6.a.._....{..>B{..e....5...R.sl......A..c....".w.......H.'.......]....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\20x20-available.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	384
Entropy (8bit):	7.13164171395331
Encrypted:	false
SSDEEP:	6:6v/lhPUMEUW1vH4jFkyjxK7mCsIo5iyYH5LLkt+IAyM9qslPi2Uq6i00Sf/Vp:6v/70tuSmCs7iyQVWYyMAGK2UYSX7
MD5:	CC274EA9D3923B46A32B6F88CBE45337
SHA1:	63A38DA1B1B0B11E377C3B6567B700323E5468FD
SHA-256:	1323DCA6677345516709B850847B82CEF9773EF620767E7870B6935455E8B65A
SHA-512:	1A125155C972104B588010197B136C661C2187BD46FB66B338D541B4177F9F3529890A49E8A528E95F82AAC4763D47299937943897430A23D1AFAE43FB7762C0
Malicious:	false
Preview:	.PNG........IHDR.....................pHYs...........~....2IDAT8...1n.@.E.....%r..........O..t.#..p...p.(,.J.,+M,......58...f..hv.&.D..5.....p...Z..Vs5.(rm.<...D.2...\....R..".{..J.mN.2. &.P.......W....ins..:.....My..c.~_80..w.../..m.....ML.,....mV..eo.1......m..../X.M.K...x...7.v.V}...l..Y.......).).W...{....a.....KD(..,..r....5n.XO0.Z...3X..0.....#y.v(l.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\20x20-away.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.165577891575343
Encrypted:	false
SSDEEP:	6:6v/lhPUWsyWY1AukoKtYiK6gl1l5G4WQtSHuka+vQf1RnPxi2LeF4317q3ENa/DD:6v/7Jsy9AukPZKRS4WoSKOQzhLeCl71w
MD5:	3EE9E58CF773F52DF57B0644053E9652
SHA1:	C8389A7217139EAFF8561141470B3792188EFD77
SHA-256:	3139AE75764E485D52C73458F0A78ABD9D0CBBA78B55204F5045FBAEC49F39D8
SHA-512:	912E822018DA19DB4FE03267FC5A20A816FAEB06324AB6AC2DFCC5E5BFF62143E7A22CA719DF2F4D15CBE11DBF97980E916C28C52BA384924B296DC0295DD1C3
Malicious:	false
Preview:	.PNG........IHDR.....................pHYs...........~....(IDAT8...=J.@.....q+-. d.2.........@a...[{...B...T.....,M.b"...g...y.....a.........:.%P.c..g..p.u....,.LT..Na]E.mf...%..T....e.w..a...'..)y...t. ....x.E.T..<.a>.C..%..."......d.F...p.j,-.G7..6...[+.M..iP*...]a.....B..y..%....Z..{.qp..........c....D.:..n...J..Sh....@.\|2.^..-XG........o.1..7....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\20x20-busy.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	273
Entropy (8bit):	6.712556800600435
Encrypted:	false
SSDEEP:	6:6v/lhPUJV83+t7AsGEZviVOjmggIu0BOGxYtA+QUbp:6v/7o5XZviVNIugct1
MD5:	3B21C3C5C0CCD6F5A93CFA4D92B26D6F
SHA1:	FF2985E3E079398953E7EBC22B7A954EA3E7D2D6
SHA-256:	25A85942E65376FBD345546FB4CC169C7CCA0288F7962E5DDC57350539A9BDF6
SHA-512:	C392FEF2614A7CE133E624E0907B76B20F3CE7949C1B304279FC4E480B43694543022735D2C9D73B40BDB9DE15688996796CF1523E82B096F45702601606E4EC
Malicious:	false
Preview:	.PNG........IHDR.....................pHYs...........~.....IDAT8..... .....g.g..S.Q<.G.7r..?A<B..) ."...)r-.................30.'k....#p.8e..8.w.K.....FG.`..'...b...B`..........(..\..5k.+\|i...r........T..wH-....F.TA6.'k..%....S.a..L..u...l"....^.AL...7.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\20x20-dnd.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	337
Entropy (8bit):	7.100762070349337
Encrypted:	false
SSDEEP:	6:6v/lhPUiUm9hLEJ4RmzGtkAdSmK5QZ9Gu/eTcSOaEqJ8pI1A5KY/e/yYHMNp:6v/7vAJ4UzQkAdS95QZ9B/ScS7EqJCIq
MD5:	A543634EE221F009906AA36C87E23B7B
SHA1:	11AD80DEA866AAAA4E415E6C9768C72EB5C5E911
SHA-256:	BAB431117FEA66AA9D35F4E1C2F5533BB9D91D41F0CFA6CC006C3D176AEC7A9E
SHA-512:	2DFCDC9EA19D64E692933B7F182E9484946B45B26E16C965FE4B6F402720D7A84BD63A0EB91376696EF4B0810F0C7E431FDF31A880EA8C89D9008E6E482F8E38
Malicious:	false
Preview:	.PNG........IHDR.....................pHYs...........~.....IDAT8...1N.0.@..J !%...01...CN.5..z....".....S.......0.H.c@J....g;..[..O......0....+z9....v.....U..E/UP....../.(.^..z....X.(..3e.t...$.....f..XT.15bQ....]l.\n.......)4eV...[...[...._.&.:.."T....c..Qm...,.]D3VH,...m[P.AV....Z..2.nc....r.Tp.....'...\|..6a@...!....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_1.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14729
Entropy (8bit):	1.6059202384282871
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvOxN+Y9VbYPNBClgmsc5pJ7Fo526:KSqskEWRHxNXVbIiVsc5fFq26
MD5:	2FF54E7BB062515BF79325F80669D842
SHA1:	91B040C281C89C75DA10813A1CCCEC334822CB0E
SHA-256:	D2AC0D43731B2B09D6326BDA0ACF3B3752F85D8473E8C50D5E1BBFCA930C5159
SHA-512:	2DAECEB313E2514416ED410EB8C4ACC65254EDE5449E9424E1F67E6CDC4D362B5026AC3ACFBD7347EE27D0878C3C4F6597715A20D6316DC34965E5D9CD8F8F70
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:05:44-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:58:47-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_2.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14853
Entropy (8bit):	1.6935905159259363
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvQxN+Y9SbBCAcsc5pJ768shF:KSqskEWRNxNXVsc5f68shF
MD5:	D23825A9327DA40A57ECB4ED8F089ACD
SHA1:	A3CC53BF737219F474BA19340CB3CD95FC832794
SHA-256:	CE641CCC0C9960692442CB9112E83A3FEF369913E1EE94CAEC5FE4BD313A7DCE
SHA-512:	D45BB7EB9371D554F176F2935185C2B2A047DBAAF12F0752598F5CC53200606BC750E5F5208223A347651F81B564D16E4A96A05D6C2FE6F83F7F74B1D3DD788F
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:05:24-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:58:33-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_3.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14869
Entropy (8bit):	1.7085477752587221
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvJxN+Y9pa1nEBC5/lsc5pJ7H/xFiGm:KSqskEWRYxNXpa1b9sc5ffNm
MD5:	8FB53B235367BE60F8D5F35F91628FD7
SHA1:	FF9A9A1E25568244F269D5B8C3A191C7B592A433
SHA-256:	5BF4E3C71A89685E65450CD4EABB792A90BE1ED84B4C0987312AC78635B3983F
SHA-512:	8A9D7AB3162F2ED045ECA07DE4587CB3F1C3DAAE87280EA3F03608D9CFD4BE943683D6EF389C43BDBC3D0C3A9A9407040FD0C858B15D0180B0CE2CF5B94B3C5A
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:05:03-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:58:21-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_4.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14822
Entropy (8bit):	1.673690552172562
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEv55OxN+Y9IekGBBC4kSsc5pJ7S5wep+r:KSqskEWRXxNX/sc5fEwXr
MD5:	6C1DE952A64E943C6EC75FCD7E6D74BA
SHA1:	9569F91BA632FD0A8A0508FCCD6BE2BFE8673193
SHA-256:	B92FE14C48E5552216BD7E762EC66E60091C167DC371424C2FE6EFFE3FDC2D89
SHA-512:	2D31912D5DC0E5127D1B53966625723CF233242F0DC6FBF1BCD53105329370DF9C7CF01D29062EBE4E20633ED19FD84E012E5C33DA58D58EDD4DF33A14236D20
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:04:43-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:58:03-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_5.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14828
Entropy (8bit):	1.6770066789318225
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvmxN+Y91hOHjBCFKWsc5pJ7qTmS9mcYF7:KSqskEWR/xNXPsc5fME77
MD5:	8339EC04B232FEE5E0A104986104FD63
SHA1:	041989869C72A1233E0C92490587A7D7914BBC05
SHA-256:	9E2AAD9C4DFEDAA9FC04714399602E841409A07F746104258C451200518A3485
SHA-512:	E7D22D93603791D9EE673A431B6D430FF5C0BEED07965392AF3354CF71CFA0B8510A0108E697CCD1C6C55022F8B1DC8B1FF0825939D37EF925435F9CE5FA98C1
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:04:21-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:57:44-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_6.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14869
Entropy (8bit):	1.707497290815052
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvaxN+Y9S9BCWysc5pJ7ZMwlNB7Fo:KSqskEWRDxNXzsc5fZb7Fo
MD5:	68EE89B3A53962726A35D9B7B847B428
SHA1:	69DAAEC6106CAF9266D8DC9FB696282038BAFF1C
SHA-256:	F716132F99A7D73C73CCBDCBF2A139AF2BCED9D7B6C4D273B324741C4D59329F
SHA-512:	6E3996E9C9879100B871097F5F621EA541F5F2DE084922DE1333DCD16F0FB7CA5D653B316D04F2E353B1A2BFBF601052EF213075DA7CFE9CC06CA65E75CBA8B9
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:03:59-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:57:29-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_7.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14794
Entropy (8bit):	1.648458805280273
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvMxN+Y98g2WLBCsSEsc5pJ7k95d:KSqskEWRZxNX8ghTNsc5fKd
MD5:	DCA5BEB35DF60969EC106B038FAAEFE5
SHA1:	9EAB86B813C46B03BBCBE5954150B15A0D4C7F91
SHA-256:	6FBA76ED44FBBC4C3AF83BF4E1E62582649C6AB6B3FC3373762E9288E907C856
SHA-512:	9F04F01CD1C38DC7AAE90329291869B5301B8B2301020F2EFA385FDDD97D4B815F7F46D5B02024BD29A7A2E6F9597D75CBAC75EA717C1C8E77A7091159B420C9
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:03:39-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:57:14-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_8.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14853
Entropy (8bit):	1.6888815601045664
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvMxN+Y95E9/sBCpnQsc5pJ7/lzXzOrZzB:KSqskEWRdxNX5E1TQsc5f/lzX8zB
MD5:	30C347F772E309D7752B35A49E34933B
SHA1:	B1591B1FAE0B45DA07F0D3AD036EDC480B0A2779
SHA-256:	88A0836CC8483CF5A721ECABC3575FA039D2EAA10F0B5CB2AC00B5EF4C3659D1
SHA-512:	47B44CC0D3EEAD7D52C6E807594969DD9AF53FDEF21487BCC72CAA96D5D0E6D1F8FA77F86EE811D4BD8B28451B446E774D44A47D2F8F72DAFC07EBD55BC4D96C
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:03:17-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:56:55-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_9.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14877
Entropy (8bit):	1.7123135775491303
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvtxN+Y9MTnW+BCctVsc5pJ7yFDaYt54FGNz:KSqskEWRIxNXMTWozsc5fgD354Fmz
MD5:	F672271EF7CE289B8C76CC648041D8CB
SHA1:	4D517DAD85B210F93DFDDB10237E9D3C3FEB8616
SHA-256:	D35B658DA75D266819BFDAD1DDCAFD5EB48D28452F2AB5D3F85BAE65ACEE7CC6
SHA-512:	806B9319333235FA5B8FF0A2E4027D60E9FDAE84A7498CAF64DC4BA444E6D9EB88647157830AD49E91F2DA7327DEB929DB22A882CA9B58AB18D42741336D71BD
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:02:51-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:56:40-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Badge_9plus.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 17 x 17, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	14888
Entropy (8bit):	1.7213169660149799
Encrypted:	false
SSDEEP:	48:K/6fSN+k29W8sEvxxN+Y9aXBCMZsc5pJ7uJZ+Lo82U0LpD1:KSqskEWRAxNXksc5fuP+M82PR1
MD5:	D5E786725ACE46A33770FC282B2B6E22
SHA1:	4415C3D13318797001484E4F970039C61223A38A
SHA-256:	654DED5E5C35C63CF73DD2AFE7D025BAEAF279F4E416D472F3891CDA9A5FC7B9
SHA-512:	B3F037CC1FC60A18584C31F93AEA43623B4895DF60915392A9D1CE1BD113244CF1172E0782103793C18224E3DDDF1DFD12404A58ABB7B85EB655622A29E11E0E
Malicious:	false
Preview:	.PNG........IHDR.............;mG.....pHYs...............8$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about="". xmlns:xmp="http://ns.adobe.com/xap/1.0/". xmlns:dc="http://purl.org/dc/elements/1.1/". xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/". xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/". xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#". xmlns:tiff="http://ns.adobe.com/tiff/1.0/". xmlns:exif="http://ns.adobe.com/exif/1.0/">. <xmp:CreatorTool>Adobe Photoshop CC 2015 (Windows)</xmp:CreatorTool>. <xmp:CreateDate>2016-08-30T22:02:02-07:00</xmp:CreateDate>. <xmp:ModifyDate>2016-09-01T12:56:19-07:00</xmp:ModifyDate>. <xmp:M

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Error-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	850
Entropy (8bit):	7.646599648906913
Encrypted:	false
SSDEEP:	24:sJuLjlhtJ68lhwe4F7r2crxmCGq+Dx/l3U6ucUT:KuLjlJ6kM7rhKDPucC
MD5:	AEC40C9F34B7A27A4D6F98A5FA3FD2AC
SHA1:	19E3262572F07449A819448C6FECED82503B0FF1
SHA-256:	FBC07B36A9A6D004E37CCD793A0F3A9F03CFE6E7C42B32325973C07F7EAE7E99
SHA-512:	8BA600765C077A05BEFEC2E1C75B1EA47592E1F1BECDAA96210493CB2FF4E438CA1437C10C43AC709088F06B33D5822A5186BC4949AF347B578046DD63281501
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx....p$O....37F.l.m.m.....p.m.6&.....2;..l..S...{..7.....}w.N~..pR,A...t.#+..vah......U.zIA....#1q......&.t.%.{..,...f...ch...).&C..s. .L@.9....,0a......:.....P.;....=...............;...H.`.l......E(=......v.J/....u4..=.$.a....X.".5..B...9..6.~Gm.7z.`az,N.^+y.`.Dn......&.r8Zi...%.!..`".i.......vDB.O.`Bix..#..=..h.'.v.A.U&..H.hv.M......B.%..._.W......TS..W...`\|....y...9...\|Sn.Ga..!.f.q.....?,j`p$....LIm.f9m.@.>kr.o..'..`/.3\...k..ah...<H...mW(.......G..........5...].&}.^}7.+..-.8../.U(..............W.z...~.z.........qb..X)...Bo.(.<...e1h....W.C..{.&..'0.........p@9...U<l...=..+O...}.8..z..v...-....`..x. t......F.....,....D.V..`..G.P#}..L...."..[u.N.......j.[.p;S.,.....0d.............s$)t.3._.v.W......f./&..zon.E...I1..6....S.....0.....s7aEF.~p....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Error-Taskbar@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	809
Entropy (8bit):	7.5594332215386215
Encrypted:	false
SSDEEP:	24:OgFrrm1UohmnW4VIze2uwyFzMauJqB7N0nPO:OQm1xhmnVIze2uVzMa/N0G
MD5:	ED5909A643C1B64C0860C634B17BA870
SHA1:	ED78D5490398ADAF6015075A7B4831058A5F70DE
SHA-256:	8260CB14ECDA3C50BDE20986AE5A481A200768CCF7B0D003F2E570CBE67F1107
SHA-512:	50A86F8C29A723B8A5C3F3F099E6D57BDF6856BE5B682BFEAB48CAAAE08834C1E845747104CC4D7AFF59C4885C49B39110A8910282C039BEE20C06C246FBB432
Malicious:	false
Preview:	.PNG........IHDR..............JL.....pHYs...%...%.IR$.....IDATH..=H[Q...7_..DC !.)1.b...8...P.fh+..7...A....SS-"d.....E...!R..-..HH\|$......K...MN=p..=....=.1".M..7.....]..........Oe.."..6...1...............$..".Z&........I.T.HK.1..y>...6......a6.M.45....?HTM.a6.....p.B.P(.$".R..[......'".P(....'.&.x.O..?".%W.H<.'.Q]...H$.5.Z.(...XY?....i..0.Z.".....+3(6.V.L.o.....UE.$.c7DvA..=&...[.7....sH...#".}....X...3u9O.[I.F.V...U_'D.A..z..,+.i.r~.z..P.....c...,..El....\K....ON,r.ga.Y..).........j4.q=..zU...p8...P.jId.8.22....xa...;[...lhF.=...Y..T.j.q...u.}.................B;.~.2..<._.H...x.w..Fg.....L.0=WR..I..[b.....].ljBV..g.zN.R.e....X[0.~W.(...}>...Uw.......J..T......<C.;.xk.1.b..gO.44.>.*.t]..;...<R,...\......}=.t.&...f._./#...e.G...)vM.%GD.....c...{`....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\MicrosoftTeams-static.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	11977
Entropy (8bit):	7.875467681340248
Encrypted:	false
SSDEEP:	192:ZCyS8Gu0ggg10lsB9QOJqmQXHY9uEdlBsyFoz7PHMb6DHUjeqwnOLn:CVu0m6xmK03BObfH2eqwOr
MD5:	D176D52BCA49B0251145F0D2E771FD3A
SHA1:	FCC3AC197579560E01267BE8D1326B990CC79FBF
SHA-256:	3A32FFE8257806362AD8DC95920BE0CEC7A5A1B4ACF476C07F423890AB298101
SHA-512:	A44BF00E46FC41516CB54354D85D650111E21A95E742731DCF64CE235A328F6F54AB7E6C90EC4120910C0F72E70AD9206781DE3D83278CFF48E07BCD3972F59A
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....tEXtSoftware.Adobe ImageReadyq.e<...kIDATx..}.....9..=3.....W...DA...]5...5FE..#j......F.5.].1.?..-1.&...A..."..f.d`.a.....WuWu.:}....U...St.tOw.z..}.s..L.A......4............................................................................................D%C4z.c..S=...+A..C.(.....i.....1.h.#..(y.#..Q..(.Kh.._.\|!.......O>\|\|..B./.#f.....\|.=...'.....5.`..WVJR.T.......@..S.@.....Zd.7....2_`.KR...}.)..4=..D.....[.......h..{.L..>r..I@.@..>K.;..:Z..=Y.oG.d..x.....5....!.......7....~.........(S....E.f.w.=./...T.O~.j....k...'..E....tt..u_.....5......!..w=.\|....C.~%.....e....6...E.M...&...b..a.qE.(..$.............B\@.......:.....(.L__....z.l..A..@X...{6~K...Q9.D.......-P.`. ,..(.DM..(..?.1..6{L"......y...et...1..F.y....Z......o.c.?7...(....s.~....@..B/....~"..Z.0...z.....B;?...-.b!.....\|.w......V7..0...`F..g.x..=.r..X.+.A.....w.........1.;+.pd\|k.Vyw..*{."....y.\...M....../~...~............[....".....x.........B..DJO....

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Activity-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2031
Entropy (8bit):	7.878956854443785
Encrypted:	false
SSDEEP:	48:UcrNpelbtDQTcg348iFtzxUYoz6buqmmastNVf7:PrNA1tDynivlUh6S7gtD7
MD5:	660CEAD0B666C9A632C38A7D417E0B7D
SHA1:	1DF4395EE940A4FD76313BBAFC4C020E5628A858
SHA-256:	1C5A79487A33369D025985767BB618C8AEB743449D7A0DF56923390FB858ED60
SHA-512:	56A770557B6147D2A12EE9E183E6267DCB00287CAE73B9334AB781BEF82138E1D14BD77992E4B09D67DDD330A4AD95C204E08986C7480690DBACB838C2667D8A
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB.........IDATX..VmpUG.~w.\|..&!...$! . -......v..`.X.......t.....H..t.j.F...B!.J..h[D1Uki..Eb....@I 7..._...}...@C...=.....<...Y..sc.....>;...Ts...MVX.......".yK..-.R.[.X..x....{z...z=$.......}.y..6).2$.x......_0...]...-.c..y=..G@.w?+4....b.[<.......:w}5Ksm.;k....Z.L\|. v..-.....l.K.l...w..E..Z.Ry....R..$[..Gs....8..r.R..Je~.v.O..x.E ...u.&..5..n2..i..8c.R.bZ...(.d-.<..8.`.R.m...5Zg..\|h....>..r.%..W\.#.+%.....R.j.....T..Lk...~.=4.F.X...f.......J.Q..+.pj.6o....u21..)..`.&D#..y..7l.e......\....]B.BcL...0..(d..y.....\.....eZ....9H`l...+.~.'4x.,...S...fF..w...w$i...'_.U..%..S.."..Hy.K?.y...Z.ERz........M.S.y2.....E.\.$2...%..t...S/...H..:.6p.X..G8wZ.\|8.;.....P....",...:Q.l...:.h&....#...}o.b..D...d..)4.'......VE..r.A.eY...D..'.!........v"..}....:.y..I.)8...{..w/_..#y...q.....T.fT......R.._hzl.}vn.G0.a.%g\..&[....>..=..{A......B/}x..S..\...o\..>......>......U...3w.eT..?...4..=..3G.YFD.Em...JyL.....C.....

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Available-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	826
Entropy (8bit):	7.715748580322733
Encrypted:	false
SSDEEP:	24:QeTlUweQzsTQGOXosmEytV6LGKvqdsQGV:QSnrGRfVjYV
MD5:	76E9F771BC71BF5BBE0E94DA2A30FCB8
SHA1:	C0C5CE03B89D2143F8417FD8C9FB048CD5E9956A
SHA-256:	2E3D2A248287F8F0BE738F65689919BE11A63B8CEF0D29316C49A0BA3B8CE951
SHA-512:	F5B1E2DC13CE591A9244C136534301E1EEEB6844CE8A4057A1DC2F557081E7DD3EC08D4DBC34027AD799BE484EB6959209731FC6D1A6769AD3C2F8B648AAD78C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx......O....Rl..BT.m.mg..,.S.m..1...d.j...[U}....}.6...!$.:c...N..].}.ky}NH..6.CU.8...U..%.! @.[.k.'.....K.;.......f..2.p..A.#.. ..9Hp..z.!'.^........J0...Q.... .ej....../g#.7.A..{4...6..@..KF 4..V..Bi....`..i(..a..j.'...d.......XHH..23...V@QT>...=.=..a.yj......sl>e....."2.....<.....V...JDU...@T..X.*6.+.z..FW..e.1...%.g\|.l.....8.a........,p...W&....>..............._....y.$..w+.3...#"......o.l.A.....Dl..S.BZ.-k..U.$.L".Q.Y.M&S...?..{..k=.......u;.....A....7../.....`.a.H...E.........F_p%..z=s_d..I7.f..}.S..6.x.5..c..H...-....6^..../...........H.....t..r...h.W.(h.8.j..v...-......c.=&......Uq.U.m..k.....Ow<+..s`PM..O1..p.Q.Gq..9A.T.......dPUE.NX.......u\ ...H.!...,D.. ......38.L....!/D\|......q.c.u$...8B^..-.....f....ty_.~......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Available-Taskbar@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.586861262688589
Encrypted:	false
SSDEEP:	12:6v/7XqV4Sf4OhTDLFrwaTtJpJLL8Tk6UMvwzbl05ANGHZm8uSZsFkhw/iG6:zrDJwYdJLASMoHl0iN8k8wFkh3G6
MD5:	C3884CC8AE7433A4030812A6411A6C2C
SHA1:	85392546E6A214AB6CFE645FD2D3FA1831C3836E
SHA-256:	FBA14A73CA6E8F75E821965CC48D84DD23C2227DFC82EE3A2FFDD583091E6E3E
SHA-512:	184F82C872787AB32B6836A38E58AD48406B4E68FD2F6BDB737385BEEA3458491F684C1E8C8588809E3AD36F4287C29F8AA703DCF7A0540EA55057A2A63491DF
Malicious:	false
Preview:	.PNG........IHDR..............JL.....pHYs...%...%.IR$....UIDATH...K.Q..?+[j ..Q..@N.v.Qr....e..B).....^{.Zc=x4....U..V.DO!.@.....L...k.M.B.C..i.....YED...%....Aj.........}..\.....[.>`._......./@.i.....m.+...yd....W...7.S.6!.i......IF6.CV.iY.e.1d.$#"".u.l...0...(./W.4...O.2Ww.O........XD.......~..Z__/.."..%..{].\|.I<......U5.d....g./....zZ%..H.<[.ZB....P.l../...m{..V.E.zG..N.&f...r.L...{....Q.\..5&S..~.jA.0.`4>R.d.h.DC.1..@.".{W.X.2....b.....0@..[..m.!...B..5....O.-.anz.>.d.XDo...y;;;..Z(A.s..9..Z..Az.hm.n............n26`pqutX...r./........R..+[l..5...u.........`};....K....}...Y,.c%sDC....K.@...M.......1...t......;f..p..?.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Away-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.640087957587639
Encrypted:	false
SSDEEP:	24:XIvtZgSmzYRjgNBTenq6X10I2DFxrqydzrVra:0bB5RjgNQnq6lN2hxrqqxu
MD5:	CE5B63679D01546956C7F94BD6C6F0DB
SHA1:	F6620052FC252FB5CB1933288B79B9A9BA715B05
SHA-256:	E056314EFE0E988A266AEB80EFCF0A99E114053D026BCF4A92DA1678B932E820
SHA-512:	A5267EC50F3416BBCDB21C9C07907320ED36473060F1D2BEF0105E45EADCA37AC88B93C0EF10900A35573217C1B56F3D5D0CFBAD3A01FEAB6A79DEED90803C52
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx......Q....j+...m.m.Y..'.m..lk..9........[...].....X...ry@...1....s..+..a(C.C.k..P-)......}....w..}}.>.'.7..%.hv......8.8......A.p......t.k.>.w.u.....{L(.hv..n.>.jh..Wr......^Y.g........R...%g+...f.......i.=...t...H..".i.......!.Q.dgK..+.$1>...5..:..a.y.7.J...K....3>P_...3.a.i.....$..ES.G.+..-..T`._..f~.A..tk.....q+.cC&/.... ...q..}.=....K.V....Y.\Fk.....\|......7<...wJ........~..)...]S...M.h.v..W....0....~.=...M...Y.c.E8S.2).X..^.9%.....-:b..*Q..........[.....$@.......u.....v]v.P.C..H...RE.k4057.v.V.n.\|:.67......H.(p..Z..h.t..v.i.Y...[.r......\........2D^l..E....D.}.y.n..,.B:X.QA.h...#....=.A(s.......>..".....@b.k../@.i...9..q....,N .'8....q.."a...a1.q....;H"......i.....fD..9..X_^......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Away-Taskbar@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.429308116382508
Encrypted:	false
SSDEEP:	12:6v/7z04viy3r6kkCbvgRsikkTD9CflP9QqLry0RurN:OaybnMRsi7al97nd8
MD5:	F19186877B2661C7A95F32BFAE8FBCDB
SHA1:	75FE3F5E2D6ED0E729F25BF0763A50235BE91249
SHA-256:	B4C2BBD0955DAD8C3941A7AA94466805CA97F25DBB2FACD593AD37439782834C
SHA-512:	F18F32A9376B1FBC166E02F2E65DBE3B904B5F9634D93B3A59DBE368E256FE14EB8DB254053D3E0657A3F2DD8E721070E581C64C8F0F38B745D7BBA0D0BD505B
Malicious:	false
Preview:	.PNG........IHDR..............JL.....pHYs...%...%.IR$....(IDATH..=O.P....:...$PU...)...-.(...[3%......[w...N0y.....)[.,D.C8.:....1..C.%!q.@Q...L.9..8.9W..4L...?.......!T.q.Z.'.@..;0n.......-..P.P..$9..g..I).[..)..um.J).....j=9..t]/....I...z....>u.b.~.$i..W.......FAT.Y].K..8~.J...[.0.Z.~.J.u........#!.<.y....V......gu.5m@DW..@...71(i.......g..$/.Q./.\.js).;..P.,..AT.KI)..$..j.......r.7.`.:....7..,....4...&.i.M,PZG..&..s...L&...oM...b.kA....I.^...r.l.."..G..+..B$.PR..d......j.k".1......Lh..;.m.j.k...@-...I..."...P.o~...Y.H.q\|R1...z.`...........cd.NI..w.x'J..#.w[.{.. .+4.Z..M.5..........Q.....l..o....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Busy-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.600289432124494
Encrypted:	false
SSDEEP:	12:6v/7ia4IFY3rV9orl4klm4CYBSnkurLF9Ov/To+sOnpoQkEXhJsAkEhzgu4:gvY3rVTSrCYBKrLF90rtFzgu4
MD5:	A3005A327B19B7978FEFD5BF2455998F
SHA1:	56EB3CF0ED9FE45195B4E437C1EA6D6B35D79BE7
SHA-256:	373968F8C0B5D17C6144ED79F0363277B6D478BE7949AA032D077A7B80599854
SHA-512:	18D11DFFCB504656AE8523B299FC1191DD990C82888BB1C3291EC267FDEFF3CBB115D0220EA8749FE12DB0610B44ACDC1B98AC35839CF99B0C10A36B60562718
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.bp/.!.....n~.....{9...Dax.n.".m.x...m..k+...m.wO..)...\.M.....;.......~l.s.p..3d@C....%.....g"".\...ck...=.x..l...N..u....W..x.2........>r...,...-..9t&.MR....>.$./(z...}?...^.... ...P..j...#C..#fA...K... .$?C.&t,...@r.....#....:q.o...5..S#M...P.:......H.&.a......kY=..v?...xl.g.`.."L*..P.... `..q...r.w.e~..S..FN\|9..[Ac.r...R.U.O<>.g.'.#'.X7f.......p....J..^N......<T;h.s.`.......D....S\.h.f....:!m..........k.@.f..T......?C..B..]....>....V2r.L....K..j.g$......h........@88X;....3..M....5....-.=...n'.\|P.t..........h...(.....K...oE=L.'K.8h.D. .:.7!.. .\\|.m.H.A..?C..b........f..>f..r.."<Ya...........=f...O.#.#....H......s.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Busy-Taskbar@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	610
Entropy (8bit):	7.5437326286996615
Encrypted:	false
SSDEEP:	12:6v/7XqW0TM6K4jLHBzhalQE+6KMv6NaSIrGgL:8H0w6K4jFElQEnKMvQ1ISgL
MD5:	3277C3F3547CBB4B726E60A82CBD3C0A
SHA1:	759EFBF170BF7A968ACE14CD73EC89DEE122DAE6
SHA-256:	80EB681A8AC10F5CCABCDD0A9BDE22490B246131A1F916F4B9C0F235F49A2FD9
SHA-512:	88344DB14B64D5198CAD991CCF1F56EF3FBEB6ED068E26B0D5818B4C44B6E2C7483A041AF68C36DCA5C137CE41A0702B20156A0B61E36417F4CC825E3DC06040
Malicious:	false
Preview:	.PNG........IHDR..............JL.....pHYs...%...%.IR$.....IDATH..K[Q....>.......f.3.+.A.A7. 8.$.:.Ep......KAWQ..NEpQ.E#.b.E...#>1........:....;..{.9.j"B3.C..?..t.....@..?X..e..=...z[....`...._."R....CJ..b.4+...;...!.[.O..!..aLT.........O.e/1){.I.O..\|qEDD..a......z...3.c...4.....H....G}g )........t....i. R).?x>....xO....v=o!....W/s....c.9..K.Rj..5.q45W..P...hj...P.Rj..k....Q...{z./.V..d...u&....=......@~.P......@Kk....].Zv =......+.A.c.. '.i........7.].?.........aht.5(4:L).vx.e...........c..;J[j....e....}.Z.......3r.[_..3_w.........Lz.0-....@...7.D..........;...;.8X....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-DND-Taskbar@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	639
Entropy (8bit):	7.532521537341042
Encrypted:	false
SSDEEP:	12:6v/7Ypz0ERRYQsbkrEXLgyjAAUfutEEXMhk+Kn1vJbpSg+4SNrzU2+se7:dpz0OePAyLmOXMLeppdSNrXVe
MD5:	79CFFBF81828E8DB5C689A4D0342D633
SHA1:	25C405C6FF051546344E5797AF3DAB8F6545708C
SHA-256:	C9038276189E344C0B6A50F17FE31749236BD1DFF6E4AC94867C12208238DE13
SHA-512:	B74BD2CE9C745F49321952C884DDE7B5E653F4EA8320EAE85B24D092FA1A2F10F971720C519870D5895A1B6F983EB385272E12C93A066C9526E61BDEE974F65E
Malicious:	false
Preview:	.PNG........IHDR..............JL.....pHYs...%...%.IR$....1IDATH..K.a..?g...!.BmB3..b.E.8.&...@.\..X\.".......R.U.3.S....E#..E...#FL.t9Kk..R.......y>.s..\|.SD...&.....}..h..(*...7.U....n..{.M..._.....O@.......!].... '7.`..t]O.C...r..j..)...ED..d+....l.&d+....%..)...5M......AT._...E.Z.nK&.....z&..Jv[...U...."b.#EQ.@.\|Rx....C.%..3....EWj./O...G-/.=..k..\|].G\-^...l].@....Y\-^...#.OQ..j.<.:..;~...y6g{..9.......7?........:.+...hqe.....:....}}}N..2..7...........$.No."A.t:].h~...l.#..'m%~.q...P...xG....;:L1..s...T.jk...1...!..NZ.c.m./..W...kZ..NM.f....].9....t..hn.\NM.f...........rM...S.....U.....;........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-DnD-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.655197221865182
Encrypted:	false
SSDEEP:	12:6v/7iPQM8I8WGaTWrEdCR4zRWyhhIIbe5OkgOVju+MpDswjjfpVC+tjSdQwKUUlJ:1l8WGaTWr2JhhI8rkDMRjpVT03wa4
MD5:	9EF1BA6AC89834BE4BCDF2652D91F9A5
SHA1:	37BB5053B85C273C97DB452E100465A54BCAB084
SHA-256:	C968C112C0C0618FFA946F66DFAC8A89C459DE386C68FFBDC57B08F55C494AFE
SHA-512:	A2CD4D4C8AB04B993E038E066A48DCD9C7E233E2345DD5AEE4CEEE3A09006B12486E877E202313A23EA86C099E7EF2D131D8A9B1C16FB270A2D2A9ADEFC48290
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx...C..A..'\.....m.m.N..b......L=.L.z.s.Qw.....vZ'S,^..x....W...\|....c...p.......@-.........,......?.....L....2......P......`?......5'o........m.e..g...R.w...?W.^..u.y3.!.A...".t.K..j..,.!s\.. ....0.....i......tX..$..z.....2...S..HJ.(%E#M.....p.s...56R..x...[......}-#....m.X.".Cb.. .&.pR....Q.y..un......sV`y...].d..Y..%.a:.zV...Gk98...E......UD5...\|U.{.G.l....o....K..;.g...1..;..t...[..7..D.z.F..wjt.....\.=.....N./_.u5..!:C.t!ay/h.b.I..U.M+...%....C..T..^.@..B...K.....&#.........E.%..5....A.&...{..P..ID+..tZ..~.)^..6........ua.y...,6....g.?..G...Nt.8..`....=..aV..(....J$.....P..Xz.r.&......IK.D.3.....,Z.\.7...\|..`~2.L/.x....am.mF...05...5....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-NoActivity-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.889588847495016
Encrypted:	false
SSDEEP:	48:2cYMDkXYwILC2BDvSV+kVJsmmry81eCS77f:2cYDX4zDOBsy81eCCz
MD5:	66B8A7879F873B338725C8B06BDEEF9C
SHA1:	59113F7785B10BC695E5CE1C8B39026702B5DA3A
SHA-256:	17E176E07B09A91E6BF4D0F5B8A9F3BB408DC4509C796EBD715D94EE2DBF64CB
SHA-512:	3E8E671C8875E122DFBA16B2D5CA9EAD0BFFC3B9962344F59560BCC25055554D8C9290532320426FD027C7552A11DF8A2C134147B88D22B81936AB3C9D961F71
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB.........IDATX..V[.U....e.}.an...B..i..U.../.A..Skb......@...b_....m..mMJA2. -.4V...F.E....93B.38.9..\.u..._..s8..@.t..Z._.........7v..._,z......X.....^.Z}.D`.5F......$...#.v....!q...z..7x....C.... ...x.....x`w...%!.......!..I ..g...2.kc.=.........6l...p...[...b.?>...l..>.......m..Z...k.(...X.Q.....;.U^..'.Q..:~Tk...w..!..ss..Vw...\3....:hZqy.gl.2a..I..,.`..q.........\|.v..S\|bb .Ut.s.fc...W4..Z.....H...:.....0...oY.\|.71./7oy{......u. ..ba}.qn............q..o..S;.. .g.p..........E..h..\.E....D6OpVxPA...c0...........D.DsHB.0...x....$..thtp...#IZVf..u,...R.Vk.X.a(.q0.K.W..i4[.T,1>..........+.....Zx~..O......o...;..6IN.....;.tt.=.yn-.....=#..2de"S.4...".+.dK$..8F3A. .RYF.......U..g<..#8.&...._c.>....v.ls]7...e...(#...........;.q.1..8.......(...).=.....+.....eK..`..?..p5.h...9w.M......i.....^Oy.a...=r..6{....Uhe...k.c....{a.m......\|_.H1...G(K.mL......%Fp.:^..B...:n...$..y...<..1...9..6.z+Q%u.....C

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-OffShift-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	751
Entropy (8bit):	7.657343452469019
Encrypted:	false
SSDEEP:	12:6v/7i64ICoQNmtX0ZwUGeAgb7PpQdrJyIvFvaCegiBm/QOWnIJzJsw8nPbvTB1L:A7QN8X0aUGepmdrjvFiCegkm/QOWn0zO
MD5:	160222AFDBF0DA6FF4270259EAC9CC7A
SHA1:	161FFC365ACC545A7DCB427CCF648EAAFB41B472
SHA-256:	2F185DEF8CDC592886A49D084F370547576C2E5A569010A73629CCB99AB4D74E
SHA-512:	A5BECA160C0AC39AD2AC3AC3BBACF3729CFFCF9730DA5BAE83AF5770F3FDD1F99C675D4D43036C3162DF0DD095D91C9E694593474F4836019A8F9F70114FCFE8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.bp/.!.....n~....Pk9...Da..Qm.UP..m.m.m#.m7.m[k[.....Mng.t.]l.=......&...~s..]....C..p(Tf.........#1~.....?8n....>.o......:.p.MG.#...`s.........sZ`.....c.A...'..l.A@.m...#'^/C.9...q...FO..M.\...C@.W.Q..B....g0..6./B..CFxd...H.........h.JJ.(+S@Q.\|&.FeT.:...."..XN.;....(.W....Q<n.}...v..........V..2..T`.K....-.}D...pIV..w..y-..e.^...l.YO:......3-...zx..N.....E.....1U`...5 >>.fhh.....e.g............(..@.! ....v.t..u...4.v.$.U..wA..[..l.f4.\..".cbb....~......x....I$@......./>...p1.@2`XT)..aaa.4.O.....{.,....[.......U..t h.E.Q.F W0d.....8...g}2..m.....x...:l..I..D\|O.R.Y6..Q...G. ...+$.....@"....,D..P./...X......j.. ..g..../.7...d!..w.G1...z...)...?..#U..4.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-OffShift-Taskbar@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	602
Entropy (8bit):	7.510184275333155
Encrypted:	false
SSDEEP:	12:6v/7z2GQA2a+O5p5FKcgaSq9iA9W6u6qNyHc4+roo/e+W0C0tN:i2BORTpgaSq9RY6u6Q+o9CkN
MD5:	A1FCF1611EDF144263CCEE6DBD435028
SHA1:	98ACE5AD5304BFEAFFD090619A942286886C088A
SHA-256:	98301CB2E7EF13C92207FFEAE491ED29EB7F47152C14E571F6FAB928F39F4916
SHA-512:	E414492BD6C0B187F655F198C739EE7D3BAEF31AE999DB3C0072DA2804C12A75ADABD537941A3C59E682DD3B7B7D87DCEB66865B1BAF7F8C0A5448E88678903E
Malicious:	false
Preview:	.PNG........IHDR..............JL.....pHYs...%...%.IR$.....IDATH..1..`...D!...qS.d.....w....B....D.w...M\...;t($.!.k...qH..t..b5W[..}...I..~..p...I.A.>.\|m..(e..T.....O.]..9...s/... 8.^.R......Y..m..R...zO............"....C>t:.F.....j.0.t]G.4..$..}\.%..m...r.....BPn..N..0....j5.4M.....a..8.Q.%....r...\|..="rv....h4z.N.....8.e:..h4z.....9...oYVWU.i.....i.....M..@CQ.rQ{W.r.....q.S.....A..=`.T....P..u].z@u].UgV.@.V.U9.q..k.?).u..W...`..^}p.$..v...}.j....i.\|8........].%..!a...............E.ek.q~..e..e.:.@D.o5C..m..(Jf.Y.a.l6#....a...MBU.4.....]...^\|.....p!e=........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Offline-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	751
Entropy (8bit):	7.657343452469019
Encrypted:	false
SSDEEP:	12:6v/7i64ICoQNmtX0ZwUGeAgb7PpQdrJyIvFvaCegiBm/QOWnIJzJsw8nPbvTB1L:A7QN8X0aUGepmdrjvFiCegkm/QOWn0zO
MD5:	160222AFDBF0DA6FF4270259EAC9CC7A
SHA1:	161FFC365ACC545A7DCB427CCF648EAAFB41B472
SHA-256:	2F185DEF8CDC592886A49D084F370547576C2E5A569010A73629CCB99AB4D74E
SHA-512:	A5BECA160C0AC39AD2AC3AC3BBACF3729CFFCF9730DA5BAE83AF5770F3FDD1F99C675D4D43036C3162DF0DD095D91C9E694593474F4836019A8F9F70114FCFE8
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx.bp/.!.....n~....Pk9...Da..Qm.UP..m.m.m#.m7.m[k[.....Mng.t.]l.=......&...~s..]....C..p(Tf.........#1~.....?8n....>.o......:.p.MG.#...`s.........sZ`.....c.A...'..l.A@.m...#'^/C.9...q...FO..M.\...C@.W.Q..B....g0..6./B..CFxd...H.........h.JJ.(+S@Q.\|&.FeT.:...."..XN.;....(.W....Q<n.}...v..........V..2..T`.K....-.}D...pIV..w..y-..e.^...l.YO:......3-...zx..N.....E.....1U`...5 >>.fhh.....e.g............(..@.! ....v.t..u...4.v.$.U..wA..[..l.f4.\..".cbb....~......x....I$@......./>...p1.@2`XT)..aaa.4.O.....{.,....[.......U..t h.E.Q.F W0d.....8...g}2..m.....x...:l..I..D\|O.R.Y6..Q...G. ...+$.....@"....,D..P./...X......j.. ..g..../.7...d!..w.G1...z...)...?..#U..4.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-Offline-Taskbar@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	602
Entropy (8bit):	7.510184275333155
Encrypted:	false
SSDEEP:	12:6v/7z2GQA2a+O5p5FKcgaSq9iA9W6u6qNyHc4+roo/e+W0C0tN:i2BORTpgaSq9RY6u6Q+o9CkN
MD5:	A1FCF1611EDF144263CCEE6DBD435028
SHA1:	98ACE5AD5304BFEAFFD090619A942286886C088A
SHA-256:	98301CB2E7EF13C92207FFEAE491ED29EB7F47152C14E571F6FAB928F39F4916
SHA-512:	E414492BD6C0B187F655F198C739EE7D3BAEF31AE999DB3C0072DA2804C12A75ADABD537941A3C59E682DD3B7B7D87DCEB66865B1BAF7F8C0A5448E88678903E
Malicious:	false
Preview:	.PNG........IHDR..............JL.....pHYs...%...%.IR$.....IDATH..1..`...D!...qS.d.....w....B....D.w...M\...;t($.!.k...qH..t..b5W[..}...I..~..p...I.A.>.\|m..(e..T.....O.]..9...s/... 8.^.R......Y..m..R...zO............"....C>t:.F.....j.0.t]G.4..$..}\.%..m...r.....BPn..N..0....j5.4M.....a..8.Q.%....r...\|..="rv....h4z.N.....8.e:..h4z.....9...oYVWU.i.....i.....M..@CQ.rQ{W.r.....q.S.....A..=`.T....P..u].z@u].UgV.@.V.U9.q..k.?).u..W...`..^}p.$..v...}.j....i.\|8........].%..!a...............E.ek.q~..e..e.:.@D.o5C..m..(Jf.Y.a.l6#....a...MBU.4.....]...^\|.....p!e=........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-OnShift-Systray16x16@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	826
Entropy (8bit):	7.715748580322733
Encrypted:	false
SSDEEP:	24:QeTlUweQzsTQGOXosmEytV6LGKvqdsQGV:QSnrGRfVjYV
MD5:	76E9F771BC71BF5BBE0E94DA2A30FCB8
SHA1:	C0C5CE03B89D2143F8417FD8C9FB048CD5E9956A
SHA-256:	2E3D2A248287F8F0BE738F65689919BE11A63B8CEF0D29316C49A0BA3B8CE951
SHA-512:	F5B1E2DC13CE591A9244C136534301E1EEEB6844CE8A4057A1DC2F557081E7DD3EC08D4DBC34027AD799BE484EB6959209731FC6D1A6769AD3C2F8B648AAD78C
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....IDATx......O....Rl..BT.m.mg..,.S.m..1...d.j...[U}....}.6...!$.:c...N..].}.ky}NH..6.CU.8...U..%.! @.[.k.'.....K.;.......f..2.p..A.#.. ..9Hp..z.!'.^........J0...Q.... .ej....../g#.7.A..{4...6..@..KF 4..V..Bi....`..i(..a..j.'...d.......XHH..23...V@QT>...=.=..a.yj......sl>e....."2.....<.....V...JDU...@T..X.*6.+.z..FW..e.1...%.g\|.l.....8.a........,p...W&....>..............._....y.$..w+.3...#"......o.l.A.....Dl..S.BZ.-k..U.$.L".Q.Y.M&S...?..{..k=.......u;.....A....7../.....`.a.H...E.........F_p%..z=s_d..I7.f..}.S..6.x.5..c..H...-....6^..../...........H.....t..r...h.W.(h.8.j..v...-......c.=&......Uq.U.m..k.....Ow<+..s`PM..O1..p.Q.Gq..9A.T.......dPUE.NX.......u\ ...H.!...,D.. ......38.L....!/D\|......q.c.u$...8B^..-.....f....ty_.~......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Presence-OnShift-Taskbar@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 26 x 26, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	675
Entropy (8bit):	7.586861262688589
Encrypted:	false
SSDEEP:	12:6v/7XqV4Sf4OhTDLFrwaTtJpJLL8Tk6UMvwzbl05ANGHZm8uSZsFkhw/iG6:zrDJwYdJLASMoHl0iN8k8wFkh3G6
MD5:	C3884CC8AE7433A4030812A6411A6C2C
SHA1:	85392546E6A214AB6CFE645FD2D3FA1831C3836E
SHA-256:	FBA14A73CA6E8F75E821965CC48D84DD23C2227DFC82EE3A2FFDD583091E6E3E
SHA-512:	184F82C872787AB32B6836A38E58AD48406B4E68FD2F6BDB737385BEEA3458491F684C1E8C8588809E3AD36F4287C29F8AA703DCF7A0540EA55057A2A63491DF
Malicious:	false
Preview:	.PNG........IHDR..............JL.....pHYs...%...%.IR$....UIDATH...K.Q..?+[j ..Q..@N.v.Qr....e..B).....^{.Zc=x4....U..V.DO!.@.....L...k.M.B.C..i.....YED...%....Aj.........}..\.....[.>`._......./@.i.....m.+...yd....W...7.S.6!.i......IF6.CV.iY.e.1d.$#"".u.l...0...(./W.4...O.2Ww.O........XD.......~..Z__/.."..%..{].\|.I<......U5.d....g./....zZ%..H.<[.ZB....P.l../...m{..V.E.zG..N.&f...r.L...{....Q.\..5&S..~.jA.0.`4>R.d.h.DC.1..@.".{W.X.2....b.....0@..[..m.!...B..5....O.-.anz.>.d.XDo...y;;;..Z(A.s..9..Z..Az.hm.n............n26`pqutX...r./........R..+[l..5...u.........`};....K....}...Y,.c%sDC....K.@...M.......1...t......;f..p..?.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Taskbar.ico

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows icon resource - 18 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	173040
Entropy (8bit):	4.832679284786238
Encrypted:	false
SSDEEP:	768:AiqHqn9DG8ph3Xo4/b63NenDiUUrSARVorXWdnPYCMXq/kQa1GzFuf7GrE26gSfK:zIq9DG8ph44/b63NerdCJvvyK
MD5:	22D1375BD7192D1F401F6D70A8D198E1
SHA1:	149EC849122994ABA816B2116ECB0BB8A59CC117
SHA-256:	CCB7318B3897FE71E315F0A902612CD8DB0649BFA2BD0FC96FE547BBEACD5DC1
SHA-512:	627AE7ED5D2659B94CD04BD8667FB27B4136CDB77881E665D8686BF0A178364E5D25927B736B4829B7709474E8EE0C05A6956AB64F947AF625E95A1B96841616
Malicious:	false
Preview:	...... ..........&...........(.......@@......(...6...00..........^... ...........*..........h....2........ ..8...8..``.... ......q..PP.... ..g......HH.... ..T...m..@@.... .(B.. ...<<.... .H:..H...00.... ..%...>..((.... .h...8d.. .... ......~........ .....H......... .............. .h.......(... ...@..........................................................................................................................................................................................................\|x......DDD...............L....\|\|x\|\|\|\|\|\|\|\|H...............L....\|\|\|\|\|\|..\|\|\|H...............L....\|\|\|\|\|\|..\|\|\|H...............L....\|\|\|\|\|\|..\|\|\|H...............L....\|\|\|\|\|\|..\|\|\|H...............L....\|\|\|\|\|....\|\|H...............@.......\|\|\|\|\|\|\|\|H...............L....\|\|.\|\|\|\|\|\|\|\|....................\|\|\|p.............................\|\|..........................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\Taskbar.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 128 x 128, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	3436
Entropy (8bit):	7.712873233142204
Encrypted:	false
SSDEEP:	48:BVPPsZI483A9NMMEqRhAC5jFaC0a0itucnLrMANQbQ3TSLj5eHiXMdYueh6HS:BV6fWA9NMMJTFa6XncOS/kQMdLeh6HS
MD5:	E041F5D2D1C815F7E1571AC1806E6CCB
SHA1:	1960B0B26098226FB6EDCF170FC393B1D21FC007
SHA-256:	EE81C0517E6847077B697F053BF9774DCEA897176126DDFC45D75BF9EAC07369
SHA-512:	25A6D376DE134A007812C29FF1652C3C16621489783133888A2D91C114E25936EF1E69DE1A96C556907CF53926E75C3696ECE639B26F553EB39590BF05A859D1
Malicious:	false
Preview:	.PNG........IHDR.....................PLTEGpL...u~.y..y..{..x..z..qy.w..z..v..y.....y.....S\.NV.OY.OX.PY.NX.u}.KR.OX....NX.PX................@@y.........NW.MW....{..OX.s{.z.....ho.y..y..z.....GL.u\|.u}.v}.w~.OW.Za.Zb.Ya.X`.W_.V^.V^.V].U].T\.T\.S[.RZ.RZ.QZ.QY.`h.x..s\|.......Zb.PX.PX.s{.[a....MV.QX.OW.[c.w..qw....HQ.NV.qx.x..'U...;?x-3rNV.ls.PU..........JS.jq.V\....NW.NU.MU.gm.ow.y........4;....el.mu.rz.-S...5:}LT.ci.sz.UZ........ IHP.LT.`f.mu.]c.;>q...%^DL.LU.......LS.KS.......z..JR.IQ.]c.z..go.LT.KT.MV.NW.OX.PY.}..KT.LU.NW.HP.HQ.HP.FN.JR.GO.EL.GO.CJ.AH.GN.@H.IR.FN.FN.@G.FM.EM.EL.DL.DK.CK.CJ.BJ.BI.AI.AH.@H.@G.?F.>F.>E.tz.ty.sy.=D.<C.;B.FN.:A.CI.^d.9@.ow.@G.nu.ho...6GM.:@.UZ.ip.X_.BI.=C.MR.HO.BJ.=@s>AvAF~JO.QW.Y_.w..DK.HP.KS.BF.KP...-OT.TZ.ah.OU.W].[a.RZ.<C.[b.ag.?F....el.nu.v}.sz...6ip..D......tRNS..2...b.!Q.RR...5A...1."..Q.......................O........................&..................P$_U..z,."...1......5'x...Y3}...<)V....g9f..?7................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\TeamsIconSet.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1523784
Entropy (8bit):	2.7826692633842054
Encrypted:	false
SSDEEP:	3072:pyBbnweEwdr+e0wdM3XuEQr6SL44smFqC8lsDsIswKOQHURJpk:pyBwBKWwdM3XuEpcFqXsDdsUQJ
MD5:	1DD35B4C46E630A897578712B93608E2
SHA1:	50FCF12276F2725421E8EA584268C408C30A13ED
SHA-256:	04096FA2737F7C8724AB1B39594AF054692511C1F5AA8E70D1EB6F01E16FE24C
SHA-512:	7BA014F66103C5B68EF321F5C6778BB80391D76E23D19E74E109E326C8358603A687E0CB925D90E1C9A35AC9702C1D7AC53A494CD513A0421EA3AA6CEBB33BED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...[-pX.........." ..0.................. ........... .......................@......F!....`...@......@............... ...............................@..`...............HN...........%............................................................... ..H............text........ ...................... ..`.rsrc...`....@......................@..@........................................H.......P ..t.............................................................(....BSJB............v4.0.30319......l.......#~......@...#Strings....T.......#US.X.......#GUID...h.......#Blob...........G..........3......................................................o.....6..........^.................V.....".....;.....u.....J.....(.................9.........................A.....H ..............................).....1.....9.....A.....I.....Q.....Y.....a.....i.....q.....y...............#.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\TrayIconTemplate.ico

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows icon resource - 18 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	172066
Entropy (8bit):	4.32521391566617
Encrypted:	false
SSDEEP:	768:Dg7Z3gHhMIW7F3TGUhxkZ1OgbC6kStqJ1L3mC3g9BQ0MRB3R9HwXOeOkccOOOOJW:07Z32hLWNTJhxiQACPStqzZw9ep3RV
MD5:	247D14144A313421D8D84AA0EA54D249
SHA1:	83BEFDD6EBA57FAA3D3074AA08A28A4E8D75076A
SHA-256:	2D5AA67B8ACE13A94FD09316787E3C9ABA2ADAC767B6E2AB769A2265A2AD20F0
SHA-512:	F2D79A2A75148EFAF90A4A92980E781B1F94A4A1034383FFE5749983085EF7EAFA29D4804094296B212795501B4B4A126BC47C24A91B60C24104BC4B24D99565
Malicious:	false
Preview:	...... ..........&...........(.......@@......(...6...00..........^... ...........*..........h....2........ .$5...8..``.... .....:m..PP.... ..g......HH.... ..T...i..@@.... .(B..R...<<.... .H:..z...00.... ..%...:..((.... .h...j`.. .... ......z........ .....z......... ............... .h.......(... ...@....................................................................................................................................................................................................................................DDD\|...\|\|x...\|\|\|\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L........\|.....\|@.............L...\|\|x..\|\|\|\|\|\|\|H..................\|\|\|.............................\|\|x..........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\TrayIconTemplate.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	6.270315125619703
Encrypted:	false
SSDEEP:	48:V/6GMYLVknA9WpY4b/OBTMCkKs/cb36yKCHny3b/UHclqvRNXf2U:VSLYJknmWpY+/OB7s/JCHnS/UHclqvRP
MD5:	A0B4AB1F2D6240038BAC830C769346E7
SHA1:	D5857236C99653114A2873032E90FF1C02C9F546
SHA-256:	A0599F541C96698F0D05698C40193392526AD1243AB2054E74C559576572C9F8
SHA-512:	ED3DAEF5CD7DDE9EAA22868CF099E6774F79FC2E825A6D19D4996133A65331F40DA16E547E2D4821C458C869E12721A5B3D183DA535E21C7A72BE928C21113D9
Malicious:	false
Preview:	.PNG........IHDR.....................pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-03-20T14:15:58-07:00" xmp:MetadataDate="2019-03-20T14:15:58-07:00" xmp:ModifyDate="2019-03-20T14:15:58-07:00" xmpMM:InstanceID="xmp.iid:bee9ad08-0e7a-5f41-8745-472d2e29b136" xmpMM:DocumentID="adobe:docid:photoshop:0a69f1a8-4143-7246-aca7-bd04f9762f71" xmpMM:OriginalDocumentID="xmp.did:7b82584f-c9d4-0f43-8599-642a69c726a8" dc:format="i

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\TrayIconTemplate@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2225
Entropy (8bit):	6.720330344395111
Encrypted:	false
SSDEEP:	48:e/6GMYLVknA9WpYPJ11/cb3yHny3OHcYBLX1MmCE3oJlYw/VO:eSLYJknmWpYRH/xHn3HcsLSmT2O
MD5:	324E1FB98022ABB4B1BDC0A806BEB21E
SHA1:	D8657BDC8E2C7E345B8047E86B7774F5AD60AB28
SHA-256:	5F5A2A24BCD135378B8D2FCB67E40E406B31BE5D0D05335734080EAF12D28516
SHA-512:	298C9CF2A6B82F4AD53932C425EDC7E806E292613616C30CC2A02CC45CCFAE00C6396793E453A465B90F8A2D383EC472FE3EFAD338232588FCCD2CCE6DC0EBEF
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-03-20T14:14:45-07:00" xmp:MetadataDate="2019-03-20T14:14:45-07:00" xmp:ModifyDate="2019-03-20T14:14:45-07:00" xmpMM:InstanceID="xmp.iid:4dfaec95-01b0-034f-b7fa-d196185f3490" xmpMM:DocumentID="adobe:docid:photoshop:b51daa67-d7b8-c14a-9655-ff0678984c29" xmpMM:OriginalDocumentID="xmp.did:7dafda70-1e08-fc48-8911-77ed2508c1e8" dc:format="i

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\blueberryTaskbar.ico

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows icon resource - 18 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	173157
Entropy (8bit):	4.255331708042852
Encrypted:	false
SSDEEP:	1536:PwjdoBixRo57MBaKolFvInGKhhsbLopdRyShwhn:P7g1OInxHZdDhwhn
MD5:	0F25250F2A0751025A39A6672B8E8092
SHA1:	6D76AD0CB3234CED98E1345164ADBCB1CD65E5CD
SHA-256:	4ED6A06EB192128E4EB92091B3F513A14784586E2CCD8A1486A3E4CB5A96C303
SHA-512:	49B0FC026012185DFB209D3DF8BCEE936A37E6DA639EC4E57C5C35CB4F0D3DAFD68609EBC919D4467CF5DF7E3936A423A464CF53899375AB99B01A0DD8F94499
Malicious:	false
Preview:	...... ..........&...........(.......@@......(...6...00..........^... ...........*..........h....2........ .g9...8..``.... .....}q..PP.... ..g..%...HH.... ..T...n..@@.... .(B......<<.... .H:......00.... ..%...?..((.... .h....d.. .... ............... ............... .....E......... .h.......(... ...@.....................................................................................................................................................................................................................................DDH........\|\|\|\|\|\|t...\|....................\|\|\|\|\|\|t...\|\|....................\|\|..\|\|t...\|\|....................\|\|..\|\|t...\|\|....................\|\|..\|\|t...\|\|....................\|....\|t...\|\|....................\|\|\|\|\|\|t..................................\|\|................................................................................................................................................?..........................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\dlp_user_profile.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	3085
Entropy (8bit):	7.9066003692237
Encrypted:	false
SSDEEP:	96:3SZMtyR8uL8KSoCWG4LbDbWv878B4e9XH/8vDrb1:3N48I8T90niKe9Q
MD5:	3D1D1E720F5F2BF20E161A15228A67F4
SHA1:	8CE85D88067CAE47BBD43C85732FA4926E7924BA
SHA-256:	0A05E3FAE6920F125906F01C3E5109A6B667B5899C68FB48BC7F31C9D860CDE4
SHA-512:	9840FD1EF4E7DED66918692149CDBE6E834F3C8E5C26C8431AC1919382CD5AFBC59C5220333C9E1A7B575EBC4F39D864EE20F00D81B823E125F3A55FAFC0D899
Malicious:	false
Preview:	.PNG........IHDR...@...@.....%......sRGB.........gAMA......a.....pHYs..........o.d....IDAThC.Zk..U.?s........hK).B..1.`..B...h...MA...&.......-...........`.j..M..m.......}........&.....Lf...........4c.3.Y..\A...cA.`.>b..>.R...`q..gZ.&W...z..L.83@.nh.q.4.f.R.E.e`{.O`~..7I..=d.$@.`..!G......i........T..$.{D..k......i~........i..x..w.......!.....x........M.......m..y.C....r.i.q..o...6........j..$............L..(..J....G!.W..Z.K.-~..z..G!.......y..P.0:T:Lh..&.R..W"0..3...AH.`4..6pt..A.....!..(...p.....@.M.#69...w...x...Z._.0..`...zVl..$..B-.k..c.5...L...s.YI...uUh...G...../b\|:;...=..u.11.\.e..w.4.[.....0...^..?o.....mR....}.........`E.r#`n.(.].]~.o. d.._v.x..q9..M...,t7.$..h..".N....i.`..$k.H . P.....{...SD.8..>k#z.]}.....J....}.h....~.......~....GT.....;.n.N.X.".`x.....G.......e.B.3..I.,bf.MV..u..W......o....7.u...d....V.\...`....uW....$....Bc_.....ER.$.(..P.QZ.TI.r.G...}........C....."."....(...P.4....x....S.G...h.@..]....g.....d......T..w=

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\favicon.ico

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows icon resource - 18 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	172066
Entropy (8bit):	4.32521391566617
Encrypted:	false
SSDEEP:	768:Dg7Z3gHhMIW7F3TGUhxkZ1OgbC6kStqJ1L3mC3g9BQ0MRB3R9HwXOeOkccOOOOJW:07Z32hLWNTJhxiQACPStqzZw9ep3RV
MD5:	247D14144A313421D8D84AA0EA54D249
SHA1:	83BEFDD6EBA57FAA3D3074AA08A28A4E8D75076A
SHA-256:	2D5AA67B8ACE13A94FD09316787E3C9ABA2ADAC767B6E2AB769A2265A2AD20F0
SHA-512:	F2D79A2A75148EFAF90A4A92980E781B1F94A4A1034383FFE5749983085EF7EAFA29D4804094296B212795501B4B4A126BC47C24A91B60C24104BC4B24D99565
Malicious:	false
Preview:	...... ..........&...........(.......@@......(...6...00..........^... ...........*..........h....2........ .$5...8..``.... .....:m..PP.... ..g......HH.... ..T...i..@@.... .(B..R...<<.... .H:..z...00.... ..%...:..((.... .h...j`.. .... ......z........ .....z......... ............... .h.......(... ...@....................................................................................................................................................................................................................................DDD\|...\|\|x...\|\|\|\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L........\|.....\|@.............L...\|\|x..\|\|\|\|\|\|\|H..................\|\|\|.............................\|\|x..........................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\favicon.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 96 x 96, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	2840
Entropy (8bit):	7.779556867988433
Encrypted:	false
SSDEEP:	48:mT+HM1zWrwQcb9I+T8+wa2A/qowH+PGbDBPpG4HYbkOJ6D8g40wUneOUn9SR0w:mCDI9Ka6Phg4H03ADt4BbO9R/
MD5:	9AFAE340EF2590605D90742BE0F97AD4
SHA1:	F3A48650C7ECF4171E885291368FAF39EAFE742B
SHA-256:	DF1DE454A6FD238A4491E588742B100BE82EA01FE11CEF8A48CEFF11714EF08C
SHA-512:	6597BF732DF8E37C460EE867012C7EA00E1819F48CECB26BD434FD42137037CA7F4E6B2DF00FD6D6E147038F170872C45F638F7B75C15176C2CA75181A49CB11
Malicious:	false
Preview:	.PNG........IHDR...`...`......F......PLTEGpL..............................................................................x........z..OX.z..MW....NX.V[.........+px.GR.y..MW.y..NX.9?.sz...:IM.z..BI..!B>Cw;B.mt.u..qq.x..t{.w..FN.LU.[a.ho.pw.FN.s\|.FM.^d.t\|.kr.KS.26c\a.+.U37rNU.z..LT.==sYb.7>.Zb.HH.5;.CK.OV.ag.[b.6=.KT.DK.v~.x..37cGN.OW.x..gl.cg.W^.3:.QW.jo.u~.v}.ai.bh.QW...536als.IQ.?E.qx.{..PY....IQ.JR.QY.KS.{..MU.S[.T\.OW.z..W_.NV.LT.PY.HP.GO.DL.DK.EM.PX.CK.x..CJ.u\|.ow.RZ.LT.V^._e.ip.X`.AI.T\.GN.GO.>E.?F.PX.U].OX.@G.NW.LU.IQ.FN.BI.Ya.V^.?F.FN.HP.FM.@H.<C.EL.?G.NV.DK.BJ.y..=D.;B.z..>F.qx.RZ....v}.AE\|NW.....V].y..u}.:A.LQ.TY.cj.Zb.kr.LS.\b.LU.SZ.NU.QX.w..QZ....ry.IR.w~.DL.s{.MV.dk.EM.]c.@G.<D.EL.lt.@H.hn.LU.MU.ls.mt.9@.Zb.GO.jq.V\.BI.`g.bj.bi.MR.EJ.TZ.fl.s{....Z_.NS.:@.^f.OT.bi.LS.GN.;B.jq.Y_.GM.=C.V......ttRNS...1.........;+....#(.....%.79...r!.5&H"..R...;i.2^..2.ad..........S.W.b.d!.s..x...zu....J...y.{......G^....J_.E...SIDATx..yX.e....cv./`...E@............B!NE.QC..+3.P

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\favicon_white.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 184 x 184, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4814
Entropy (8bit):	7.603612858141585
Encrypted:	false
SSDEEP:	96:fSLYJknmWpYU2/+HnGHcNHB+Yh7TGiJZy/OeLVy7Pu2p:fSMJkntHG4h+Yh/Dy/r2p
MD5:	1628F8141497EDAC17E8C1E93137D05E
SHA1:	86FE7130B12D9CE3DBBE55557CCD3D8A08B7872F
SHA-256:	A646012E5F49DEA2318A63403896D02CBC9CC7AB73EE5D1720CDE7A02D898330
SHA-512:	8EAAE30F962C31DB8B4B1F2802E0122599EE0717A1E2DF916D18966310E29BFA931E21C7545AC8BBF409F0E1DDFCC2C327A3F90BCB3CE397DC7B07598B0BF8BF
Malicious:	false
Preview:	.PNG........IHDR.............P3&.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-03-20T14:12:02-07:00" xmp:MetadataDate="2019-03-20T14:12:02-07:00" xmp:ModifyDate="2019-03-20T14:12:02-07:00" xmpMM:InstanceID="xmp.iid:73f2d991-0721-c242-a7af-0a406e14a648" xmpMM:DocumentID="adobe:docid:photoshop:15a842cc-4eb3-024b-a858-8eaad499708d" xmpMM:OriginalDocumentID="xmp.did:0eba7b09-5abf-cb43-a4a4-e79d2d4ca21c" dc:format="i

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\BreakoutRoom@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	559
Entropy (8bit):	7.2779882687327815
Encrypted:	false
SSDEEP:	12:6v/7H7/BAhjCV0/EbjENsF01++HffYUbT6EKUi/V++PNu/DVy4mmwoUS7:cuL/v4Af7Heu/xy46b6
MD5:	AEBDEDE341B41B23DFB30057BAE2EE7C
SHA1:	0E35B6B8FD0A093292FA250BDA58D1BB942D130A
SHA-256:	4710260973DA8F2594BD466CBDE7EAFB81B70EF36209A2687303EA2A3D7599EA
SHA-512:	166B8F64BEB18376C58974D68D643763A79E159F396F49B4EBECA1D69C7408315F5D7CFF91C7AEF02A17D5D51B1CA9202420437750E9EB6C11181E571570FE87
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx....Q.@....+..(.+P+..L.v$V....@.G........qv..p..of'.A.7.@..............Z.........A.8..Lu.5C].Z.M......g.5E..p...(..p.V...2. ....p:3.3); .. <....o...C7...[..&...HpA4..k..bW......................z..^.'..t..._...TI...t..~.P87..Mk.w.n\...Bi..r..M...J..ZK..d..}+A..J.]8Ib%9..A.....a.[...'d...z.&.D!5.\...7....zh..........[......H...........................:./..n..z..{.b8..>..........+'s. q..S)p..R.<=.g..c.!.!-%nU.h..u.."...........7A.r.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\LowerHand@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	686
Entropy (8bit):	7.468895596477723
Encrypted:	false
SSDEEP:	12:6v/7H7/kWM8k9Nhsc6M8SP0fJ/Q83v7wE0bQ+sNuxWfAlSBz1AusrPkPtzJl7:LW/a7sc6aP0/RkE0bRblSBxfsTkPtzr7
MD5:	E4DA862AC96AACD347694CBEA94692D4
SHA1:	A09A03311D9F0C50A2D789C8C28184C030EB1589
SHA-256:	3E99E4A3BE49F91175367B28B9F715FB0B26775CC6A4D62EFFD0872521CCDDDD
SHA-512:	0732B14F428CEDD43B0647A83B2D8DE2EFF36C52FB84D1601A7C868F6A38BF53BDFE98F1FC2D1370EF7FDE34B6214F33CA0E57893B7541740879F0B9258069FC
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a....CIDATx...Q.0...wN.....\.......AG......n..U\|@.4.....q..........c.1..cL..0ZL......./G...1e...$...w%".1A.....F.@.8..DBd.....jK#.DX..zK".2P..i....Hh......E.?.#.u..(......b..S..X<.'Rl..u.`...=.K]...8u..u.Dq).v..{..E..S.u........{3.b.~.).:..MFJ.S...F#.....@.H.c.sE..H....6.]....M....6..?t.'..f....T#..b..)@.%D...s... ....#1._U,...y..{0...u......i..j.2X.#5.....Q....".._.F(...".Q.G\|..X...),OT;l..>C.#i...o...;...T"..m.x$...J.z.m\|.~v[.....*{...R._.(...=Y+./.m...\|A9...9h..v...`.2Bc.3.;.......,..H..i.\|..)..y,.+."..s...[u.c......6..D5."...kb....<P..H..1..c.1.T.......QOH....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\Messages@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.596632816627522
Encrypted:	false
SSDEEP:	24:zyJefEDECmwMoGZRZYqIJfd52l4dCR7e/fHxmRTcsTRmk4VCc:8ezeMoRndwl4MRgfHxmVfmP
MD5:	6CDA093165FDC85BFE957F93506F393D
SHA1:	0FD7305821C473353356D50AC10EE9C7123037C7
SHA-256:	94D573B26E154D166FC1CE3D629720243767E30EB97F3BDA165FE33A2D41EF70
SHA-512:	BB967D12E711DBB004107F89803E3191B4570C31A90F2F84EC0FE0A7E9425EDC1E614FDE34448429A2237A5A8FFAD7F0A56124F3C4489499E5D295076C44E6CE
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx....Q.@...W..@:...T.. ....J......A......t.@....i&.....\|2.....1.z.t_.B.!..B.!..48....[......E.Q...l.M.$.+K...Zxk..8'91K.W)......Mt.f...9V..U...<...O/.....z..YNN/..K.$.{...[cxl.R.)5$(. .....O...N..78}@.K..c..{.@.g!....nbz.=..%./...jb....M.i5....gd.s.V.]A3...=a....i.t....d.....OL3c+...e.a......0{>.......V..X.r\|F......mf....^.@l....jA...b..r'..R....&..2..)A..6A/..=P.? .%..&(................!.<).s...}.....r..tP..g....!..<...G..%...lM..=qj.6.+(7.......T.z.M(y....M.J.Y.....Zi.........-...Q.y...P.d..$.C}....2./f..oM..l.u....n.#.4...5.4...g....n..X'i....l'.Z.1.............;.n!.."..g..Nz..".B.y..............z.a.o.OUVK.!..B.!.0..1..K........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\MicMuted@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.503143515526269
Encrypted:	false
SSDEEP:	12:6v/7H7/pctIncoXNRfcrZPXP5ODgm5vZ1D2YHrgN/fAi4wZ7uf5L6U2It7xw3z:HtKX0rZPXR855ZB2C8fAjsqx647C3z
MD5:	2109838A7A5CA063418738EECEBE5F4E
SHA1:	41220D5F861E4AF612C209AD9E52A306197E23F4
SHA-256:	08458ED9715C6EB56EB29A3AF8E51CC64CE06354E0297055D17E1BA2C797671A
SHA-512:	9051F000D40BC0B79D2BEB07996857AA8E63ED4603906D13369A9EC4781ECEC7B61CC2A3117EDB958B87BF903B65A68C131D5B1AC10B69F66A6DF9CD210140D7
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx....0.E....T.wp. ..].q.(...O!.$.p.P.4..X#@ rho..s>i..gy..L.(..(..(......-..`.9..f..w~we...ch!.......],.}..ZI...=....(..H.fN.._RA..T...&..r"V....z..1..Lk.Qn..v.^KM92G..%..(W.$!~y.%..?$Q.l-.$..$..V.H.[H"i..D.I)..20V..gI"...kX.$.......DR.8...%.T0.a.(g0r...0..I1}.....z.b......J..sw$.......@?_\|fu5.1......b.J.'J......E.......O......?..'V...Q".B}...O.@^.)_..WX..h.S.B{...~.:....6.=...H9`......,Z.yaJ.r..,..bjLSu...@.......ohoI.....X..IhsQ...z...........I.......].r.m...DlcA...bm4.$....;.;.G.......j\|...+.YJ..^...h:1E..R.$..U...%.aB..~..+d..\|..KZ.....4.n.B~.?.+*.J.%.Z.8A...D.r..$V.cH....W.5..&.[....(..(..(....[;.tV.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\MicOn@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	666
Entropy (8bit):	7.3770559558779105
Encrypted:	false
SSDEEP:	12:6v/7H7/wk5tXZE/akFxGZlOhXmwXVJaakU4w13O6SFI:c5k/akFxOOPXVYakUL2I
MD5:	85F267F27400D12AADCAD952DB88BE4A
SHA1:	EA523C0D374BEE0265C29E6ED9FDFA0BA53F2838
SHA-256:	0CA7BA0B47E8C1BFCFC72229365CF58560FC2DDBE0E028E794D0DFBA9B902E31
SHA-512:	6C7930F188C70FE0FD4EDE0FB4CFF1578E53C3817DC22D11F0D97E15252D4C1D563C94B038A9D1DCA9A61CE2081832B42E1ABA5E4271682361C9CB0BDCCD3A2A
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a..../IDATx...Q.0......u...n......l........l.6.../6.ily@....w.;hKK.^c.F"........f.eZ.d.`...P...2-Yg.4$r.c.v\|:...U.9..!.t...kI.L..+).{J.{..R....-).;J......DRWPv....)....)....)....)....)....)..$7.3.5.D..g.n..K#....>..).@@.>........m....F.1j.w,}...^?..V..&x?n.w.}....s.....?...:I..{..=.oc.....'}$t..&p..r.,....!...@.....MU.e...qA..J\|..u..._.E..'.z...U.:\|E.p5X.oK.........."..t.G....v)W.....'.nn.Z....Y./.oW.3.Q.....2...d..\|..F..v....L...........%\u,.<;.LA.%...sU`.A.?.-)d.W..+.Ruo...[....gE..z.3.+..3..R ..R .\..j....'.......Z...!...J.<....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\Participants@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	662
Entropy (8bit):	7.500528984748096
Encrypted:	false
SSDEEP:	12:6v/7H7/OmiQN/wtuHthIwUqDVL/NnQj+bl0Zf0MiB6wN4zpPl7:nmtN/QqD9/NQm0BpN
MD5:	EE3BE319807DEB3E8597DE68C11DB6D6
SHA1:	E16AE92714A89510F10B2C7D30BED353E1ECEB30
SHA-256:	336C83D6F4E41954AF898890B27C4777CC99D6AA2F40AFC26EBB23DAC1492CB0
SHA-512:	3BF02AC3C8D9BF357FC465BF3F9D6AE13AD2BC84C9E8DEC623FB8B41634163530B39F1BEF6B95F37D84BE921EBCC0D112C4FBE7D5AAE7D4C8B118590F14E159D
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a....+IDATx...q. ...O...@#d.z.f.f.f.w.{...............B.8gGB@...w....................ED.Z.-........ZZ..cqK..wZ....{.[.FNHp. .x...Y..}...or.YV..hC.%..L.....4.=.t.n.j^...p...L..y..>..+.J...k$...\|@..L..H$G.z.{....P.Dr..xO(D..}G.......8y...: n..Z.O......gI....s.4_.t.p.v.=.W\..#...v.]M.m5.^E_...,v..;...z...l...3...f..{.:..u.9.-J....6.Z......"i#.}.=..u..Q.T>....).$......=.7.5$.....`.F...E.R..G~.:...".t@~...M...)E.R....kH.g.3...@..^.i.5B..J"6o../..L.+w.f...U..m%.........(.\..o.3..........as..].....v..q.....3C..../}..ADDDDDDDD....v..Sb.K....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\RaiseHand@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	587
Entropy (8bit):	7.3772009500673255
Encrypted:	false
SSDEEP:	12:6v/7H7/iNNnKk2AKeFxZ9leldNzFq0yrqIYS5y9z7rUL6TBj:tEkzK4sz0LrqIJ54TBj
MD5:	490B3EB3FAB0FF9D76676434D8AF5EE6
SHA1:	D1AF9DD68F07AB9025F2D777E14A36CDF8C4CE28
SHA-256:	5C7BBA88922528D6E702A6FD5AD029B79D9A164D8FD534BE40012A1BB4B1D379
SHA-512:	8750FF2D51F26A534644EA1DBA106E7D870603A6E7C4AEFB36250F54FF04420A60A45EC9C0A44951AF5A1C1A372D77A163C7C506E6D472CE053DA76C315C561D
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx....Q.0...O..p.F...@.@..:.:...........A\|...G.k.BH..]...8>.. """""..2.....nA.\0.v...2aS..}!..K$4..&S~}ed..}..................g<...Q.E..4.b...c@....y0 .....<.....`@.'.HV.U.q...b.Y.N...O..x-&.=.......^.VNk....{...].O.k.^>L.6...s.....Nm/.v...0.....6..Pj@..<Hi-Cg.+.g#...._R@...`>.QI%V......Az...+.h..4...H{.....H..Tj_..Te. .#+..I...h............j.,z...@..V.JK.:(..H...DTvI.2..K. Qi....L\|.7di.5b.Y#=...0.=.E..=.L{.<..%..67.{..A..C.%Z.NY.......6my.ADDDDDD....b.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\Share@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	509
Entropy (8bit):	7.102409722459139
Encrypted:	false
SSDEEP:	12:6v/7H7/4Qno03sZLLpUBJY6c1u+3Qc0FnKGV2wN:yX+pIY6c1u+rWK8J
MD5:	4656A1616DF31B5AE00D40B1497D1A5A
SHA1:	9CD31B103341E34D432177DF85B3AA0239EF3800
SHA-256:	D0928DFE0B6BF394C5C309A3B420F70D80CB0D3C631580269EB28398140BF012
SHA-512:	544874EE66097B6568B287ADB4D281C3B71AA892E083F662D46346026251744FC9F6B4FF7FBE5D3BC8BBD3E9BB17B76744800331B2E5A4E003E052EC65CD4FF2
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx...M.@......0.n..N.N.N.#8.N.N.#..7.NP...,..E.kx~.j.H.\?,H.......p.F..........-.x...4....8.6...W.W.Hg.3glq...o.3..T.a.O..t.. 'P...@.}.9.N...j..l.m..p_..........x....x+1Qa5...8.-.....T:P.N.^-.J.....WC.R..v..yg:.\:R.@A?..e....~...(..D..8.......ud%.}._..v#...J...l...xS.8`.e.....J....9.....K P.....@...%.(.@..J.).d.rQ.<......J..a....%..... ..@k..ZN\|.*.=..?.?a..8....{u..........O.Py/u.ks....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\ShareCloseTray@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	497
Entropy (8bit):	7.185833824483844
Encrypted:	false
SSDEEP:	12:6v/7H7/8E1rdObMO/sL/1+MiDGksH63DEfdKdvICJDIuGotZcH:eObMvL/EVShaIVKJICJ/e
MD5:	DDCB9C8CA834CE27C21391CD30E7BD5E
SHA1:	067637B353C2C0F2F5AB314F800E438C2A859D5C
SHA-256:	556FC2CE9D14BECD1976BE6E38B474569C6DE945B24E01A1589C2469626E9976
SHA-512:	B4BB46AD5B7FEEC9426BDFB307E6BB15255CFEBAC4DF6FA4B76955FB12B80C1D842298A03EF160579516EEECF8B4D2F5F8F90167535DB52101BF4B997755F279
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx....m.0...N.....B&..$.p#t.t........j..C...]...HV.D..+#............-U...>..S.u./.6..4>.....9P..+.7..w..k.'.u+goq:.o>.d.]....6..W..%..;....s...P.(..2.(..2..H.#..os......4Q.o2P"X.i..+!....#...DS?.....V...../..H..=QG...df..8.D.......VN./......g.j............M.4.q...H..>.......M.[.g p..h.....H....4.a...l3.F....+.....@....@.%.Z.W...@g...F\|.*........k.}-...P.............r.%.U-..1.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\SpeakerOff@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	528
Entropy (8bit):	7.303967565028983
Encrypted:	false
SSDEEP:	12:6v/7H7/fSqKtkFtDCUQNt/69N7TcnFnsD73YPSD8Axoz/7:ntkFtQNt0cFnsDzkSDlM/7
MD5:	70410A23852032FFFE1BE6AF94915650
SHA1:	52AA1057BBFD9895C7F614DB94108C318174121D
SHA-256:	AEEBAB5512387BB379368E7D274C460C55F8EE2863C97030A15343E7270A940F
SHA-512:	F97340BB0EBB500A7F08279E61454C71A5AB65DD0AE202322A9FC0B3F1A3C84E1427C1AF54C15A15C634DECDEABA6D8BFFE4CFB7411A6B2AB24DC5276169D6D0
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx...m.0...S..:BG...(.. . . . #d...t..OA".a.....$+Jx.............,......c..R..)..u......}@v./.~.\..'...8.r3&.....u.....N.....?9..z.....}.[+>. .{..-]A...'u@.....*..7{7.....YG....V..."8`h0.....U..... .&.S...C.8....<..Bb;.#bb..zN.M.S.....B.%....J}u.....@.....!6&.uC..w...``87...u<(..r.....j.<..\|.Y..g..:j.W...1....v`D..!a...W...Eo...X..?r"...8..iJH......&/.Q._........FM........~.R..EDDDDDDD...[....Yj.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\StopShare@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	497
Entropy (8bit):	7.185833824483844
Encrypted:	false
SSDEEP:	12:6v/7H7/8E1rdObMO/sL/1+MiDGksH63DEfdKdvICJDIuGotZcH:eObMvL/EVShaIVKJICJ/e
MD5:	DDCB9C8CA834CE27C21391CD30E7BD5E
SHA1:	067637B353C2C0F2F5AB314F800E438C2A859D5C
SHA-256:	556FC2CE9D14BECD1976BE6E38B474569C6DE945B24E01A1589C2469626E9976
SHA-512:	B4BB46AD5B7FEEC9426BDFB307E6BB15255CFEBAC4DF6FA4B76955FB12B80C1D842298A03EF160579516EEECF8B4D2F5F8F90167535DB52101BF4B997755F279
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx....m.0...N.....B&..$.p#t.t........j..C...]...HV.D..+#............-U...>..S.u./.6..4>.....9P..+.7..w..k.'.u+goq:.o>.d.]....6..W..%..;....s...P.(..2.(..2..H.#..os......4Q.o2P"X.i..+!....#...DS?.....V...../..H..=QG...df..8.D.......VN./......g.j............M.4.q...H..>.......M.[.g p..h.....H....4.a...l3.F....+.....@....@.%.Z.W...@g...F\|.*........k.}-...P.............r.%.U-..1.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\Video off@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	584
Entropy (8bit):	7.302778588994893
Encrypted:	false
SSDEEP:	12:6v/7H7/s+xhi1bfZBbh8vAXfe/yuf0f8PwS5B6YFH4EpeGE:qMdhqAQI8J5JVeGE
MD5:	99A70351A78CD3C1874176CE84F3ABB0
SHA1:	D6F88EB842B5C9612F23DCFA9853A552F9981ED3
SHA-256:	E9661B52AD885E44D6B19BCE8A51C28941FAA0D370EA314F02A8E44F2EA7FB52
SHA-512:	8580E0D531540784807C9D7C0BBB5B9934334497F07DF6B9DB79B9E7EDA422397260F389B2173F691EFE7EC2B70CE3F631212D1243D198E239180C85AF0D1792
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx...M.0...+..A......6..t.V`.F...>..R..v..Y..)...=^.Q.........=.a9a.1....b..H+.)."e@.... .8..(c.....^.....8...7...5..:jIF..$._...\.%.`.....b./...c..;sF..q7...>'.Tm......,.6..U.ie6^...@...."-..+.6.Hq.fv$.......*"Q]..\ .T....&.)..H.f...B....v..O....?r.C .6..@.e$O...H..)W.<.Rn"y..."...HME2.=......-.Rs..'..HME....R e...@.4R...Y.V.).H-.....^.J.m.[..3....8....;.57.o.8.#$.1-Gz'.R~.....,!y.i..7..d)>a'...YBr...b..[.%..H{9.I../.@..%..H. R.D.H..)."eH#...".........M..!..=T(<.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\macos\touchbar\Video@2x.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 72 x 72, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	417
Entropy (8bit):	6.950003366236431
Encrypted:	false
SSDEEP:	12:6v/7H7/bQMU3LVIgleLbg6lMtBUTl5Sk5yQ4N:cQMUegleLbd+aGQq
MD5:	D3CADBAC203124C96D5A0747A523B5ED
SHA1:	ADDC077B5821E5E0F884AA3B4D7759557B03B8F1
SHA-256:	FF9E1ED90629CD56047600DCD40C0B2461E944AFDB512757FCC269F28D844091
SHA-512:	661E8D42116A0215569172E6C121C20CD5614DD9E9CEE5166F777F9C11F1629A866232ECA58BE2AEB8F6395811EF23EB4800C1C633AF9E7F6DF10568097AA305
Malicious:	false
Preview:	.PNG........IHDR...H...H.....U.G....pHYs...%...%.IR$.....sRGB.........gAMA......a....6IDATx....m.0....t.0J7h7.. ]..d....:...j..-......?.o!.~a..........`.T.O...7^......_Z.I"..'V$..U+..9?t..i.R.N.B+.3.w....9.....7<..(.^d.Wig..:m.......$.8...y.........'......vsH{!..@....d ..@....d ..@...Y.@]..s..[.;...k.A...N.>.!RI.?ig....J.]......H?R..}.\|X1.Q...y.KM.'./...5#.s..?...T..........`......ho.S,....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\msix\teams-app-icon-150.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8164
Entropy (8bit):	7.968078686178688
Encrypted:	false
SSDEEP:	192:5ShGf+PGgNKNGKt7oRZLb+Q5BfoKC8+cH/agXzquvsc1zoqFaq6:gcWDQjwZLbNjbBzqlc1zoqwD
MD5:	101433263BB08BD1C23DAC5681879E89
SHA1:	B483FAEAEA9F38CED611FED0FC45DBCEBAD21822
SHA-256:	31C6AFEA4EFD925309BC2B903BCF3DF04F49FAB49E3A129D90A1D5B87EB1EFBC
SHA-512:	4B12F43A79BA4C6AB6DA5BC43532C407D2A82ACE4D2B2F0CF7A97E994CC99C8BAB35CFB2E87E2C88EEB5BE2AB9FD23B9E4CDFCC84D315DE3EA71006DFF3D838D
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a....yIDATx..]].$Wu>..gv...l.]lP.1.A!H^G"....(.D.......(Q. axA....N...Dy.Z....2(..C....J...@.. .....?.3.uro.{.9.v.L..u.t}.lwW.U]...\|..[..5j.Q.F..5j.Q.F..5j.1.@..)Z....`u..h.S..{..;x]Y.k.....N,A...X=..Z.........6]r...T...V..2L0jb)\|...\|..O.`d.;.K.`g...0....A......x.v..:..._.u.&..O..R..s.W .4U6..$.`...W.\|..".%.<.N.5./>q..)..L.byR!.-._,SA..y..%8..Hb..T.. ..../...B..?.p..4O.d.5Q............\....D.k....6..c...<......cZ."....w...?.Y.&L.bF}.0{.W}R..{....g..G.,N...K...Zl...W..K.:...x...\|"....Gk%.....sgN..].../..6..D.}o.x.......l..1..z.....W.e?s.k.v..Ps.P..D.......gw.`.b..c0...`.P.T.y...(....+.n...X.0.2.#.,.C,\|........,...\|}.%.'.zY...c....m..R.\....u..U..<...`m.....L.z.6.H.'VQ....`....\|.*U1.{.:..Z.lq..E&os..B`.?.]..W9.>1........u....=.&."..b.ss...&....c.,...n0..s....<..p<.x.....N....\|?..~(D.....;......`8.....p....f`;@D..h@.y......^....<u....m...9..u....D......e.......

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\msix\teams-app-icon-150.targetsize-150_altform-unplated.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8164
Entropy (8bit):	7.968078686178688
Encrypted:	false
SSDEEP:	192:5ShGf+PGgNKNGKt7oRZLb+Q5BfoKC8+cH/agXzquvsc1zoqFaq6:gcWDQjwZLbNjbBzqlc1zoqwD
MD5:	101433263BB08BD1C23DAC5681879E89
SHA1:	B483FAEAEA9F38CED611FED0FC45DBCEBAD21822
SHA-256:	31C6AFEA4EFD925309BC2B903BCF3DF04F49FAB49E3A129D90A1D5B87EB1EFBC
SHA-512:	4B12F43A79BA4C6AB6DA5BC43532C407D2A82ACE4D2B2F0CF7A97E994CC99C8BAB35CFB2E87E2C88EEB5BE2AB9FD23B9E4CDFCC84D315DE3EA71006DFF3D838D
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....pHYs.................sRGB.........gAMA......a....yIDATx..]].$Wu>..gv...l.]lP.1.A!H^G"....(.D.......(Q. axA....N...Dy.Z....2(..C....J...@.. .....?.3.uro.{.9.v.L..u.t}.lwW.U]...\|..[..5j.Q.F..5j.Q.F..5j.1.@..)Z....`u..h.S..{..;x]Y.k.....N,A...X=..Z.........6]r...T...V..2L0jb)\|...\|..O.`d.;.K.`g...0....A......x.v..:..._.u.&..O..R..s.W .4U6..$.`...W.\|..".%.<.N.5./>q..)..L.byR!.-._,SA..y..%8..Hb..T.. ..../...B..?.p..4O.d.5Q............\....D.k....6..c...<......cZ."....w...?.Y.&L.bF}.0{.W}R..{....g..G.,N...K...Zl...W..K.:...x...\|"....Gk%.....sgN..].../..6..D.}o.x.......l..1..z.....W.e?s.k.v..Ps.P..D.......gw.`.b..c0...`.P.T.y...(....+.n...X.0.2.#.,.C,\|........,...\|}.%.'.zY...c....m..R.\....u..U..<...`m.....L.z.6.H.'VQ....`....\|.*U1.{.:..Z.lq..E&os..B`.?.]..W9.>1........u....=.&."..b.ss...&....c.,...n0..s....<..p<.x.....N....\|?..~(D.....;......`8.....p....f`;@D..h@.y......^....<u....m...9..u....D......e.......

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\msix\teams-app-icon-44.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.825300175596613
Encrypted:	false
SSDEEP:	48:o/6WkpNnbEqZLr0AS9oSrr1dK3Uc+pX7FGdif9:oSWKpSHrTK35uLcC
MD5:	B63112F40B2C27CBCAC61F4DFFCEB7AD
SHA1:	08D1EB190BA51520B20C80E1CF5889F1D3AE715E
SHA-256:	7E0EBE079C5B959443BA5F80A601641BAD071C7F0A9848BBA2F4732943C3CF1A
SHA-512:	4964544FA673E47F529C4E00174F9E15ECAA434A103C94A0AC0E5B1F70513151311742662DDAC72F3B99EA1E221D13F884B54867CE8C11AF64293D1592D0FB60
Malicious:	false
Preview:	.PNG........IHDR...,...,.......Z.....pHYs.................sRGB.........gAMA......a.....IDATx..YMh$E.~...L6.L~vPv.,.x4A1...E......I..a%Y<....B..a....$7Y=...[.(......d.e.du'H~....W]?]=...^.cf...U.W................P....pv\w ..BG.........if....x..D...].g...."SK.....:Bx.Jn....-......h..t.Hv.a[J...b...{7R......F.g~...6!.v..:..3.".1..N....0H..e.H&3?......Eh..D..].'=...d9F...~....1..`....-.z.$t...>>.7..o.....eu..+..0.F....`.:.....P.2..cA....#.\.Ru....p.V.........C..p....R%.M ih.. ..,.0.(..IL.._IN...".K6...~..>.+k....x<...W.0rJ....$..,z ......8..C...+.k...Gf}....Bu`....a.;.K).EDy\t"..e......j%.c.//.'..,.s..FE...d..;...,P"=!.F..h........\........^.9.....\....2L.b.._.0T......F&3^V....u&=.(..\|wu...q.....\|t...1;..O.G"...Z.(/79..X.KL..2.+....oB.SC5k...v....Q.....<.yx8R...v\|x?..S+A.t.\|.....K.@...:.t.4.Z..cM......3.A...aEx..sN..L7.a.<... @..$...B..N.f......>3:.'.T..?......n...F....d/.....4.&e.......S.....B.l..N..z..G)s.2hbB...TB>*8R....zJ._.ar.QzMY...%a#..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\msix\teams-app-icon-44.targetsize-44_altform-unplated.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.825300175596613
Encrypted:	false
SSDEEP:	48:o/6WkpNnbEqZLr0AS9oSrr1dK3Uc+pX7FGdif9:oSWKpSHrTK35uLcC
MD5:	B63112F40B2C27CBCAC61F4DFFCEB7AD
SHA1:	08D1EB190BA51520B20C80E1CF5889F1D3AE715E
SHA-256:	7E0EBE079C5B959443BA5F80A601641BAD071C7F0A9848BBA2F4732943C3CF1A
SHA-512:	4964544FA673E47F529C4E00174F9E15ECAA434A103C94A0AC0E5B1F70513151311742662DDAC72F3B99EA1E221D13F884B54867CE8C11AF64293D1592D0FB60
Malicious:	false
Preview:	.PNG........IHDR...,...,.......Z.....pHYs.................sRGB.........gAMA......a.....IDATx..YMh$E.~...L6.L~vPv.,.x4A1...E......I..a%Y<....B..a....$7Y=...[.(......d.e.du'H~....W]?]=...^.cf...U.W................P....pv\w ..BG.........if....x..D...].g...."SK.....:Bx.Jn....-......h..t.Hv.a[J...b...{7R......F.g~...6!.v..:..3.".1..N....0H..e.H&3?......Eh..D..].'=...d9F...~....1..`....-.z.$t...>>.7..o.....eu..+..0.F....`.:.....P.2..cA....#.\.Ru....p.V.........C..p....R%.M ih.. ..,.0.(..IL.._IN...".K6...~..>.+k....x<...W.0rJ....$..,z ......8..C...+.k...Gf}....Bu`....a.;.K).EDy\t"..e......j%.c.//.'..,.s..FE...d..;...,P"=!.F..h........\........^.9.....\....2L.b.._.0T......F&3^V....u&=.(..\|wu...q.....\|t...1;..O.G"...Z.(/79..X.KL..2.+....oB.SC5k...v....Q.....<.yx8R...v\|x?..S+A.t.\|.....K.@...:.t.4.Z..cM......3.A...aEx..sN..L7.a.<... @..$...B..N.f......>3:.'.T..?......n...F....d/.....4.&e.......S.....B.l..N..z..G)s.2hbB...TB>*8R....zJ._.ar.QzMY...%a#..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\send.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2920
Entropy (8bit):	7.5549021331572055
Encrypted:	false
SSDEEP:	48:utYfgqd2a4olSrFU3ACB4x8YA7WCjQMXJVVEJe966666666666660KI79iTrdyoP:Uqd2atFACdYAeMXHVb79Udyo3/
MD5:	808D381B805B691990250094BFC10AAB
SHA1:	BBE4218ED09027DB8DFE9B200FCBD48AA11BBE40
SHA-256:	322E21B7386D3D6AFBC95348420FF697607CFF500CC80B4FABE0061CA8AB153F
SHA-512:	9573A309C58A2380A2E180B2E569530FD1D1B6A4A1340029420CD0CE9F5380A6BFF7755FF7AE4E41D1DFF37CBD02470ABE8280FC7D6C4CFE1171B0EE33ABEED4
Malicious:	false
Preview:	.PNG........IHDR.............\r.f....sRGB.........gAMA......a.....pHYs..........o.d....IDATx^..O.ee..p...\.....@..E.&.h.%.(.%$..e.P..BQ...D..IBABF.02..ta 8.@...4.,\...,.w.>.>Z:..{.{.?..<..w.w...}.9..{.u.......................@ov.7.....Y`C...:....b.Y`C;Qg{..S.A...&..a...&..a...&..a...&..a...&..a...&..a...&..a...&..a...&..a...&..a...&..a...&..a...&...../...,..`?.&...,....vvv..%..I../!.\.....e...M.,..`#B`Y......!.8.!........'....7....\|..:!..I...!0?..N..y..tN.....B`.......'....6.@..t...!..I.0.!0=..A..i...N.L..`.B`..........J..K.0:!0...$..q..&C..O.0)B`X........\&.w:....=..tXB`.;u.....,....\|&o.....)...F).+.c<..J..muQS....hH^.......2.J._(?...C@.p`y....?..j.:S..Q.! ..H....qS..l.'.._W.! ..W........l.O]Z.P.........g.._...R.........O{6E_...J....sX>..Yf.....RZ....R..<.1.LZ...Xz....)..,9..@C.T...K.?..7.......ST..+..O.9.?.%...X.<=.....V.r>>[ZZ......8....ieW.S..S.0..Y.c.`.yJ.I<.....s.H......P....={....z.n.....X.C.....,..GS..f.N...K....!.......yw.ku..Yz.g....Y.g9..s..{K/.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\tlb\Uc.tlb

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	455716
Entropy (8bit):	5.169510702747751
Encrypted:	false
SSDEEP:	6144:Rs3/0+NAoXAY6nuKGiUpXWFgXFQIY0EH7+0BJmmDAvQNRplh/y6woW0nFTF958lQ:A8CX0Qky6cp+7B
MD5:	E3C8B42670EBB0530EE81F427671AAA1
SHA1:	F8C75ABC800C7326E6E814947390C14575D691CB
SHA-256:	1B31630CD15BFDC663B9630790B968AEE407730DC94F48BB96FBEDAC9ECB1002
SHA-512:	4CCA913DD1890DBFA72195EFF3CB5856AC6C01A4A910DF719376EA13264E129823D3788EB874C222534AEE1E1CF7B3ACE71900002252449A872BB3C9447F3B98
Malicious:	false
Preview:	MSFT................C...........................y................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8...8...9..l9...9..4:...:...:..`;...;..(<...<...<..T=...=...>...>...>..H?...?...@..t@...@..<A...A...B..hB...B..0C...C...C..\D...D..$E...E...E..PF...F...G..\|G...G..DH...H...I..pI...I..8J...J...K..dK...K..,L...L...L..XM...M.. N...N...N..LO...O...P..xP...P..@Q...Q...R..lR...R..4S...S...S..`T...T..(U...U...U..TV...V...W...W...W..HX...X...Y..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\tlb\Uc.win32.tlb

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	455696
Entropy (8bit):	5.167372000083355
Encrypted:	false
SSDEEP:	6144:vtn/0+NqoXAY6nuKGiUpXWFgXFQIY0EH7+0BJmmDAvQNRplh/y6woW0nFTF9589k:98wX0Qky6wN/iZ
MD5:	2EB6C328ACE10BEE32EECB6609578AAB
SHA1:	3FDE2F845CF62FF557FD49E46FA6F761CFF4C7EA
SHA-256:	40F438A5F0D0E9FF5BBCAB29D51BC7B6CBA03548C5DB021A05426665A2F98A69
SHA-512:	E4FF466CEBA47C71046985AB1E62877BFC57D5A98F0E966C46F64FB23710C85CC2AA3BD2F4B0ABC134D18A501D7A01FFE881110FC57A8B5DDB07C89DCD4F3514
Malicious:	false
Preview:	MSFT................A...........................y................... ...................d.......,...........X....... ...........L...........x.......@...........l.......4...........`.......(...........T...................H...........t.......<...........h.......0...........\.......$...........P...........\|.......D...........p.......8...........d.......,...........X....... ...........L...........x.......@........ ..l ... ..4!...!...!..`"..."..(#...#...#..T$...$...%...%...%..H&...&...'..t'...'..<(...(...)..h)...)..0......*..\+...+..$,...,...,..P-...-......\|.......D/.../...0..p0...0..81...1...2..d2...2..,3...3...3..X4...4.. 5...5...5..L6...6...7..x7...7..@8...8...9..l9...9..4:...:...:..`;...;..(<...<...<..T=...=...>...>...>..H?...?...@..t@...@..<A...A...B..hB...B..0C...C...C..\D...D..$E...E...E..PF...F...G..\|G...G..DH...H...I..pI...I..8J...J...K..dK...K..,L...L...L..XM...M.. N...N...N..LO...O...P..xP...P..@Q...Q...R..lR...R..4S...S...S..`T...T..(U...U...U..TV...V...W...W...W..HX...X...Y..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\urgent-icon.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 96 x 96, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2034
Entropy (8bit):	7.799908493779348
Encrypted:	false
SSDEEP:	48:Kx/KKALszjP5IDLdORyLx009AP4qDlMagUNI:0KRLsxInU0GAquYK
MD5:	394CDED23C91F54DC1BAAD042F0BAF56
SHA1:	7FF0C66CF2EFADB2BCEB3671D260AD66E51E60F2
SHA-256:	EF828FB337878E4E2866898509B9C7CB644B25B2DD605B5BEB7AB7B6D1E8C10B
SHA-512:	D91C5D49623DB77EF48E64826D5549A1D68F33557F48F449256E31ADC2AFA3DEF27065BEECF7214E464705EB548A897FC0DF9D4BA854771414FE08EF6885D87E
Malicious:	false
Preview:	.PNG........IHDR...`...`......w8....sRGB.........IDATx..[ylTE...{.........B9....CL4^..."^..%.AM..D...E........P....$. ....9..-...m...m.v.u...}.m-.s..\|.f...}3..\|3.f.H@.0...Y....$..;.$@. .....H..# ...I.`..... ....`...$....l^z.$@0...K....F@.y.......6/=@. .....H..# ...I...........;.C[S..J .w..Tm....+.v..(].Z.....G.TMVm..<....<.w...O...E..X.\|..Zo....A....s_..~...~O.`.x.)..."...^B...h8y......x ....4.ee.cD>..#m.}..h.....g...y...\|.O!..1Q... .h...vB.........^x...\|..)...T\|.3T\|....T..3...-.d.b.'.ACS...<."..Pw.$.>[..e.Dm. ...9.r^,.X......Q.zxK..N<...6%....BrA^D}4......B.....@...P..+.2...[...O...Po.....y ..<.k7.a..a...Z..K..`{;.6.....f...-~...s^..)X...+.6S...f......m>..B...q.Tl.N.-.p..\].N..O.`.B.....8..A:...9.s.X(;....4....U..U..~..N?..L..I.........!..j\..Sj.e.;...W=.e..Vm..[.&L&....W..P+!......A....9....:..%.vS.nk..e.7..fO}...V%......k..4...b.'w.a.,...P.f..6..e....aix.H.;B../{ZI.`..U...f..F.^k...X.C..O..........5....2v...wKY.7.<h...-..t'.o{h..G..9

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsLogo.contrast-black_scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.539173215427748
Encrypted:	false
SSDEEP:	24:i6HbSX/S2SGL2TdBHPpmpjAUZrIiCQaVKfkkcDj3gH2SHm:iYYS2SFXHPpm2KkhZlk0j42SHm
MD5:	1F14FCD3E65F859B54982203541EAC28
SHA1:	688A64E380D8D577734E5445841E5C1C475C2D9E
SHA-256:	1C98830ABD041C4C169A2B2E067D44C7409D9936212239ED43821517CBAFAE81
SHA-512:	BF25182DC4AC5CECB6A4F43B961385762190EFF0D652540046A855EEA821270756CFE85D10B6CD5B849CC1F5985B1F1703EEFD4F34DF5E979C149960AFCA5AF8
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx...Q.0.........t.d......L@2......&h6..4L.....W.:.........%...'.......7... ...b....@,.X .........b.X .@,......b.X..@,.. ...b....@,.X .........b.X .@,......b.X..@,.. ...b......x<.I.LC..J.(q.......".......f...{..5..>.Z.r..,.....)........i...P..y.^...}.4...7..Hu......7.;."..........".0#V.C.y.......5\.i......&;?;J.Hk.[....;1....B..3...}.^..>.c...#........U..X.......#....$U.[.....W.H...]p...,b}.^.J....`.O. ...o...;..,..N2..e.t..w......O2......3......?.zK'...oy....<.+D}N5.t.0I..;Q...w.T........G}.m..<..c.%F.!.....;x...+{.a.A.u.i2....."...2...../C.E.e..4E..A..(.r.UK..=)-q]......Zt..X ...b....@,.g.. .o..Q`7x...6..OFw...6.../&...x.. -..B_.....zN....\|.t[$JR.....e.b.z~.l..8.t.S4.#...4_C.ht.......*..)O.\|4..#..._....vN.zP.Q:..Uw;..N.2QG6.....-.a......?Rg...5'Z{..m..h...}b~...!...o[.jHu6..X.".e.\|T.v.O.x%.e..F...O...n.R8HW.5..A.Ua.beWv1.L:.e...VO.&.J....8H.i."S..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsLogo.contrast-white_scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2635
Entropy (8bit):	7.086781921567285
Encrypted:	false
SSDEEP:	48:5/6sMYL4knA9WIYv/c0+M3LoHnsI18kkbcfF0/ncu0gefDClN:5SJYkknmWIYv/1oHnsI1Pkbct0Pr0ho
MD5:	634A6CB092B6F24A978DDFFF4C61BD18
SHA1:	BCA77AD5B31DAF62FF1F198DC7A284CF63B15D7C
SHA-256:	B16531F0B4DD8C309A7FDFA3E221BA7831D08545147C329289C6BD1953D316CA
SHA-512:	D3F593D3E1E84BD69F723896210EF8B637C869F8CAF7511838314B8629DD444BA4FBCA24F2ACDD783ECCB61309F206953DE2FA6DCCBF4534070665E6008D74E5
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-03-08T08:15:06-08:00" xmp:ModifyDate="2019-03-08T08:15:48-08:00" xmp:MetadataDate="2019-03-08T08:15:48-08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:6af61333-b76c-b843-bbd5-fce416c4cc20" xmpMM:DocumentID="xmp.did:6af61333-b76c-b843-bbd5-fce416c4cc20" xmpMM:Origi

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsLogo.scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 150 x 150, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	3320
Entropy (8bit):	7.8690369426173135
Encrypted:	false
SSDEEP:	48:zYf/U/+VqIxA7fag36qo1g4kDPA7rNpHxNwSToKuCk6Ugy2ovuPN/U/l:zg8WVvxAhqqo1pkap7aSToRCk601a89
MD5:	B8D4762200AE6CF6DFC6095F99991BA5
SHA1:	538AE061F49B6667EC9034FA89DC61D017585449
SHA-256:	4DDF0BA7559045DE3AEEA53D437AE30AA454DDE43BF0CF6C8E17F62B9FDEDE0C
SHA-512:	7CCDF4F8800E70046FB133FA36B1708653A02527749E91BA30A00A8118387447F03718C3E8BE97A23E1658A43526ACC033850CFE218DCF2CCF9017D4CAD089A1
Malicious:	false
Preview:	.PNG........IHDR.............<.q.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..kl.............!(...p.F.M@Q..BP.4.i.&..J.&.Em..i.~...D.(U...D.".%...MK..2.<...h.....?........{gw.......h.......{..;.a...>m... ...,.`A....... .`A...X... ...,..X.......,.`A....... ..A...X... ...,.`A....... .`A...X... ...,..X.......,.`A........0J..I.rG.........6...rB..=<..`..T>Wi...2....B.J./e.m...,/.r..I4..R.pi..(.li.I.......X..U.......r`Jq...s.h..=.`....F...w...T.XJ.L.V..C.:5@......\|[b.7....,Z.t..z5......\....]-..o.&....#O..j.. ...(...GC^..Uj.?=.Zy...~..h..U..f....h.H....47..+...,.& ...B.../.z........^i....^1..$4zy,].._...V.......l.}.G..<..V.OlZ..K.f/\g~...tN..m..rb1r.F..R..E.5..'...b...PV....=...+..#<.Z.O_..w.VU...M+_...L...~..#.~~..d..p.{/E.>.)5.P.<..@Q..J..Rb1bU.Uw.,.+.$.).f.7k.x.Be./..V,._...5.\|L.ZJ.....".....2.-#!I....[8.J.w..-.WS{.K..4..}..G..9.zYh.....M......C..m.,f%......Y.x..k.%R..3.V-..w...U.......i.).CUr.....l.H..~..jLU"......1..U...c.C...._..YZ

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsLogoSmall.contrast-black_scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 71 x 71, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	649
Entropy (8bit):	7.353929386715879
Encrypted:	false
SSDEEP:	12:6v/7gEwQsr9/cGyCe+RN+EAal4AHCXsSElgkRz5xidKZzijLC2CCENj:/9/cGyC9zHS4yoidezijLrCCE9
MD5:	99D2DC52EC927853379B1BA463CF10A0
SHA1:	5B87D8B6B1E1B0708117688ED06C0D4FA5319542
SHA-256:	A0954061763069D492CC980AA4739E80222C01B40950B3BE91512273911BF0E9
SHA-512:	26536319D398135E0913E89C662ADEDFB4A3012AFDFB37CBE3D067861C0E157670727D46FA00C49AA5D1F31F457BF5275C0B3940DD84AF5DE24DF5882E375050
Malicious:	false
Preview:	.PNG........IHDR...G...G.....U.Z.....tEXtSoftware.Adobe ImageReadyq.e<...+IDATx..m.0..q..2.#....e...t...P'h6.N@7...!l..........'......;.g..r....................p..p..p..p..p."..R..4'-I.V.9.s.."\|r._..}.GVQ}..g...1.&.30{.g.{]..6..}.z...W.Y.v..4..lC..:...P.Mpn....`....gH..Z?..~.Q>^.2-...j...k.i".=...t..t...R.X.: .Ne<9....1.."@)...W+.M.........7.I.W....._;.Hql.@}.e...HgA...nu....E..rb...],...........H7.m...w..2...l.n.9.m..wpN-.1e@TrL.L....{.a...I...-..&.......j.r.8.N......j....N.&w....>1...{+....9.f.Mck.]...@+z\|....kr.yP.,.t....&p....w..U].}..\zs.....p..r.&q..n..'.@..p..p..p..p...8..8..8..8....#....m..A*.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsLogoSmall.contrast-white_scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 71 x 71, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2017
Entropy (8bit):	6.767743953710028
Encrypted:	false
SSDEEP:	48:T/6iMYL4knA9WIYJ/c0IR0Ry8RZ3IRFHns/OnTCMjFPn6cMPSliU:TSnYkknmWIYJ/OoTaFHns/OnTC0ZrM6P
MD5:	86BABBCD8024350B7632657C07B69F95
SHA1:	87338A33A60923F2F32427A004C3EA25DDA02255
SHA-256:	CE98DB959DA190692BD87FB0532BC77357A12E2C5B859AEAA79F3DAF87855A71
SHA-512:	6A386B053E94C7221D6824239CC80ADA0737D6A1958020728106E32E8412A12F0BFF16C96CE95B1958A326CBF7A0417B08E8309AEB01566C7449A46933C01BB7
Malicious:	false
Preview:	.PNG........IHDR...G...G.....U.Z.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-03-08T08:15:06-08:00" xmp:ModifyDate="2019-03-08T08:16-08:00" xmp:MetadataDate="2019-03-08T08:16-08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:535077a6-42f4-764f-bd87-0b0ebbb6f9b3" xmpMM:DocumentID="xmp.did:535077a6-42f4-764f-bd87-0b0ebbb6f9b3" xmpMM:OriginalDoc

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsLogoSmall.scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 70 x 70, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2495
Entropy (8bit):	7.906370816474683
Encrypted:	false
SSDEEP:	48:kMLk2Mj1uKzhu2SjSjnCI17Orjw5ToOgzRgxUjcA/lkK:knD119Sj67E0K2en
MD5:	7352445DE0A65B9D4F64B5AE18321976
SHA1:	7D0E4CE5656718C9D23D9830D8C8C97F1E1C290E
SHA-256:	9FEA899073B001FB4ACA567CB48B3E4EBC49F9B501A3B4AD4D4735A1E80DD9E9
SHA-512:	7152A086BCB13EF31F63F693183F88E8AD233352A41E0DC62B346127FFAFF62F6622F195FA44EB44ED618404F8EAE6610068FE11F875C56E731199DA23497CDB
Malicious:	false
Preview:	.PNG........IHDR...F...F.....q......tEXtSoftware.Adobe ImageReadyq.e<...aIDATx..k..E....1;....+....z.@\|F..x..H.....^b<5~0Fc4&j4$..g..4zQ.D.\......x..p..;...tY.S5.........~L.t........,.E...`.0...L.&......`~..V.C.q#.P.&u.Y.B.4=.\f.4../....6'0Dj.Q..i..a(`-.;..0.6.D~k.#@.`..HPRr.e9.._7..i. -../...m.V..dy..5.p...\+H.4Aa-..5..X.....k1Vf.=.1.L.v.....=..?B........b...G....]c..+..m..n.t..[.@........?...}t7...p1..v.S.]+U..\..@...._..E...s...0Jt..uo.s.2..5.&..m..(4.1...@....l`u>..K..'V.h.a5z.ew..`J.......@..S.P7..KH.v..d5b...F.Wz.isK....1W.~....V.m...F.....G...S....;.TaD.j.$..>....3.Z<wR.Z...+...s.....C.:....V.y.&....Wr...8P...Yq^.?..>...tu_...3..=FW.@....((...7I......Uj...J.%U.),....fl...\:.N.=w.,U...!Ys9...C"...'i1..-.....E.{..0I.O...$..}.]%BG..#x]sK..7.).....S'...'Om..L]'\....,.Q.........A.>P.....9[.b[\.........0...dS...?....z...I.N......H~..Eb..Y...!@x...p..K.&L0.K}6.Jn...g...v.......................lcB....R..*......a...`...$

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsSquare44x44Logo.contrast-black_scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	526
Entropy (8bit):	7.441841581427649
Encrypted:	false
SSDEEP:	12:6v/7rRYpXb66UNBuctgRNXD60ZJtxl8eSvq3XIfI20JurFDo:46ctg/DSy3XQI20yW
MD5:	CF719AF2B225A3A21A8A446A4AD4BB4D
SHA1:	B56DA2E3CF704588ABE215E8E410B6835F74F436
SHA-256:	FFA3E653D00276A6F71C02C25ABDA74495810F74D15EA99309044782437D7C6A
SHA-512:	AC5EC1E9E179B20BB4CEB766C2D63041B773AA6626ADA39284066803CEF4DD799C0F301879A35D5701F90E6F280EF3439E7CFE4A9502AB83F9D61201F76E5DC4
Malicious:	false
Preview:	.PNG........IHDR...,...,.......Z.....tEXtSoftware.Adobe ImageReadyq.e<....IDATx..m.0.E/..0............m.Np#........r..J..C.0'[..!.'.8.1....i.1S`.V......c.>.e.........g..-.;...g.6..&...K.0Fv.....l;.......0..b$..K._b...y...\..w>..X.....q=.J...R..)+..S.D.....U.W...IiJ1.;...Iw..?`..d..'.]........z.%/.F.U........u...v..q.....F..=+....5.0n..c..+..+....\..U..Db%._g....I...`...z.lC.o.s........2..S!..u.wQ.:.V..x1..T......A...../.O......ZM*.~.@E. .Un.!.zN.......1.N.lM.......M.......[.^......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsSquare44x44Logo.contrast-white_scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1850
Entropy (8bit):	6.597390869066976
Encrypted:	false
SSDEEP:	24:o/6m1hmYaWwjZknA9VYVhEdNT3UlCjWMmcI1VP9UVwU9Pq3VPcHH3XsGTmmtA7hD:o/6sMYL4knA9WIYojW/c0y63SHnsD/L
MD5:	E3D96D88317BB7A6C5031D9A88ABF68B
SHA1:	A3418CC9BCBF96C708052D6FE6D7DFC5542C5724
SHA-256:	845C47F0B8ADDAE3F7B435E7EED1088DD6B4661E5DD8BCE87DF4E7C8FD3337C6
SHA-512:	653BE53173AC24996AA581701A6316E6EE371D27A3DC0A1EE1EB6FDC2D0DD8D595869151047DCC84B097DAEF500BA9D53CC41172C085B97854B83CE4CB1B91C7
Malicious:	false
Preview:	.PNG........IHDR...,...,.......Z.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c145 79.163499, 2018/08/13-16:40:22 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop CC 2019 (Windows)" xmp:CreateDate="2019-03-08T08:15:06-08:00" xmp:ModifyDate="2019-03-08T08:15:52-08:00" xmp:MetadataDate="2019-03-08T08:15:52-08:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:11686f50-72c5-d64c-920c-afe2b040e003" xmpMM:DocumentID="xmp.did:11686f50-72c5-d64c-920c-afe2b040e003" xmpMM:Origi

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\assets\windows\TeamsSquare44x44Logo.scale-100.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 44 x 44, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	2186
Entropy (8bit):	7.8605664218540445
Encrypted:	false
SSDEEP:	48:jz9l+cyIb3uIswJxUgK4VHj7BPzHpjo4KKcTPH1rfzQT0S9:37v16IswJxVHy4Jcpq9
MD5:	D745C73AEFA52CADD7F30CE4CD8DA243
SHA1:	F10160904D5139BBD335C6935A9BCCD4722A5BED
SHA-256:	8DD5E165948C70FB8A3C2DD10749EBEC8C58D17CA0F046074ABF739A045A8C23
SHA-512:	ECB6CC7D5DE4DC8D646D4D464543FADA55A78DAB6DDD5A9B97CE12246042CDD77D0D835CFDEDFEA8EB6B6464A860FD2BA7E93191C9629C0938696915304BA937
Malicious:	false
Preview:	.PNG........IHDR...,...,.......Z....QIDATX..Y]..W...3.Y..~..&M.Tj".jA.......)R[....T.;.J+.xX.4...O.D..RQ......DMa.4..M.M...d............<..^g..<0.hf<w.~...\|.;....v..\|..W..VG.m..p.....q.LE........... m..........9......%..M....../N?.._ .....h....\,.~...K.K....t..?GDO6...w1.9....C...lhD.v.[.<L....;..A..h.q....?..sy.1f.Wj.....;..}..5....I}. 6/.$.....`..?...#......D......c.....S...x...rQB(.....!R.m...[....&^V...X.....@.~.9.-;v...X9...3..~..Yy.......Z.}X.D.M....a.1A.8!! .."..-`d.. .mRL.0.RN.cf...O?w..E.Y.L.X.....5...1..W....v.......p.fZ.KF13..J....f.W......x'..Yy`}.f....k.P>..G...,.F..u........t..cW.(.H]g...-+.....}@.b_.....U.}eP.k..5.,.r*nbv..\|.....x........8.:..Bx]e%....]...L.0.:.`.\...}...e(..vL..b.X.1.....4\|.....).&...<xsb.....}...U=.......o.^?2....XXc...$.D$.....D...-...3P4].RE.....;.G..fH.22..C....bhh...Y.e....^:.....5.]..z.LJY.l.........q_{..}........~...sw.......8td.#............`...........^Jo.......g..<.\.5.Z...4B[...0..XLC{.....l.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\culture_mapping_Desktop.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	4413
Entropy (8bit):	4.424534886531237
Encrypted:	false
SSDEEP:	96:7bl7X7HA9dBOdNtWLchY5F6LbFc0/p7DKcOjxVh39FRH/7Gd:vlr7g9dBOdN0ghY5F6H3YDjxVh39Pf7A
MD5:	76CB1AA8C4A50B175B5B252027A564C1
SHA1:	5DCD384271E81380F1544E3D091FE9D869335788
SHA-256:	C46A5C13DA6D8973F7E0A90B63BB0F76C4829E9EDBCD66B4549BF8B76E65E002
SHA-512:	48EB5238F013E4E19F1E6754885A6982F5DB40F16FB056C921DB2F92DA916F05E166DE8E4CE79FD91D39B5E584B6D0961AC1B7AC830DB8C3E4E70EA5DB253EAB
Malicious:	false
Preview:	{.. "cultures": {.. "af-za": "locale-af-za.json",.. "sq-al": "locale-sq-al.json",.. "am-et": "locale-am-et.json",.. "ar-sa": "locale-ar-sa.json",.. "hy-am": "locale-hy-am.json",.. "as-in": "locale-as-in.json",.. "az-latn-az": "locale-az-latn-az.json",.. "bn-bd": "locale-bn-bd.json",.. "bn-in": "locale-bn-in.json",.. "eu-es": "locale-eu-es.json",.. "be-by": "locale-be-by.json",.. "bs-cyrl-ba": "locale-bs-cyrl-ba.json",.. "bs-latn-ba": "locale-bs-latn-ba.json",.. "bg-bg": "locale-bg-bg.json",.. "ca-es": "locale-ca-es.json",.. "chr-cher-us": "locale-chr-cher-us.json",.. "zh-cn": "locale-zh-cn.json",.. "zh-tw": "locale-zh-tw.json",.. "hr-hr": "locale-hr-hr.json",.. "cs-cz": "locale-cs-cz.json",.. "da-dk": "locale-da-dk.json",.. "prs-af": "locale-prs-af.json",.. "nl-nl": "locale-nl-nl.json",.. "en-us": "locale-en-us.json",.. "en-gb": "locale-en-gb.json",.. "et-ee": "locale-et-ee.json",.. "NULL": "locale-ee.jso

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-ar-sa.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	31635
Entropy (8bit):	5.190835578819602
Encrypted:	false
SSDEEP:	768:VW0dwZzELuVFfcGrGn1szZ/sWwFx82O6C66/KdLOigoBenMkVUc0jMtnlqFfzYOU:VW0dwZzsujfmnwOWws2O6pGKdLOigoBi
MD5:	2C8658509A0515474B52C899A500E0CB
SHA1:	315E2AC511CECBDBB48214E35DD4D77004CB2527
SHA-256:	C1EB0366C73D9C3520B8FF7BD178553374AEDF6F1DB197A7F85ED960EC022721
SHA-512:	7E754FB4B9B48132A586B2156CDFE6F6008EFEAD13D3826E071A889AFA3727180476C5E316DBED8DC1D6BB075BE54B4C85FDA9AD93E90447A71C95860FF3B997
Malicious:	false
Preview:	{.. "locale": "ar-sa",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "....... ........ .. Teams",.. "tray_do_not_auto_start_button_text": "... ..... Teams ........",.. "tray_exit_button_text": ".....",.. "tray_exit_multi_account_button_text": "..... .. ........",.. "tray_signout_button_text": "..... ......",.. "tray_my_status_text": ".....",.. "tray_get_logs_text": "...... ... .......",.. "tray_get_support_files_text": "..... ..... .....",.. "tray_status_available_text": ".....",.. "tray_status_busy_text": ".....",.. "tray_status_donotdisturb_text": "..... .......",.. "tray_status_away_text": ".......",.. "tray_status_berightback_text": "..... .....",.. "tray_status_appearaway_text": "...... .......",.. "tray_status_resetstatus_text": "..... ..... .

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-az-latn-az.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27986
Entropy (8bit):	5.09769108191687
Encrypted:	false
SSDEEP:	768:8ZB2bJpsMFWEA21768f7qGVE3nrnNHSCnf5Q17kb7S9TEv2m:8Z2Fr188f7qGVE3nrnNHSCnf5Q17C7SC
MD5:	07D8100F82DF3550BB9913F1CD76AE02
SHA1:	3B072A8941ED88D153289E7A9C3AD6CC9E8F1178
SHA-256:	DEE0D516395371058382E3E04104D0A5A8F6A4457F8473BB17D45BAA5327646B
SHA-512:	4232619434315CEE22F4C3D71AE73480BDBDD46331284D124F80FD56F3774E84C43731D6FE100B495BBB56DA209940901E0B13420AD4A1F80FD4FED6217C40F1
Malicious:	false
Preview:	{.. "locale": "az-latn-az",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams-i avtomatik ba.lat",.. "tray_do_not_auto_start_button_text": "Teams-i avtomatik ba.latma",.. "tray_exit_button_text": "..x..",.. "tray_exit_multi_account_button_text": "B.t.n hesablardan ..x",.. "tray_signout_button_text": "..x",.. "tray_my_status_text": "V.ziyy.tim",.. "tray_get_logs_text": "Jurnallar .ld. et",.. "tray_get_support_files_text": "D.st.k fayllar.n. toplay.n",.. "tray_status_available_text": "M.mk.n",.. "tray_status_busy_text": "M...ul",.. "tray_status_donotdisturb_text": "Narahat etm.yin",.. "tray_status_away_text": "Yerind. deyil",.. "tray_status_berightback_text": "Tez geri qay.dacam",.. "tray_status_appearaway_text": "Yerind. deyil kimi g.r.n",.. "tray_status_resetstatus_text": "V.ziyy.ti s.f.rlay.n",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notifica

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-bg-bg.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35484
Entropy (8bit):	5.107617713911127
Encrypted:	false
SSDEEP:	768:aZq1iGesbMv3wxeyiELFSZ+u2T8E+k55LI1iY1bIsY9o7wHn:aZqw4Mv3w9iELFSZ+u2T8E+k55LI1iY2
MD5:	43E7FE1EB19FA803E4FA3AFC445951F3
SHA1:	3F330088BBEF3A40D0976CFFD65219EDFB55116B
SHA-256:	423598E5D437047EC32AB048A110BEBDE4CFBB2F6F77DB716D0069640B0F3883
SHA-512:	82B2092F3B6219BC9E4DA73E6122166DA99B921953AB83A6F46536FAB2E4FCCDC9AC2872403B32FBC2C6031BEDC38ED4B5F85FB6251840BCCDCF4CCB597779D3
Malicious:	false
Preview:	{.. "locale": "bg-bg",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "......... ........... Teams",.. "tray_do_not_auto_start_button_text": ".. ......... ........... Teams",.. "tray_exit_button_text": ".....",.. "tray_exit_multi_account_button_text": "..... .. ...... .......",.. "tray_signout_button_text": "........",.. "tray_my_status_text": "..... .........",.. "tray_get_logs_text": "......... .. ........",.. "tray_get_support_files_text": "........ .. ....... .. .........",.. "tray_status_available_text": ".......",.. "tray_status_busy_text": "....",.. "tray_status_donotdisturb_text": ".. .. ..........",.. "tray_status_away_text": ".........",.. "tray_status_berightback_text": "...... .. .... .....",.. "tray_status_appearaway

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-ca-es-valencia.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27771
Entropy (8bit):	4.78357923150424
Encrypted:	false
SSDEEP:	768:4ZkQrkYtz/Ds7e/Sb5FEwx3n57ryP3k600kDjKwiUHRniGJvdzh1ZtT0KNpYh/Fz:4ZkQrkYxDSb5FEwx35600kDjKwiUHRny
MD5:	E3D87DDD746F448542661EA694EA3D95
SHA1:	695DC18F3A31A95283E635CE4B59B1DBDFFC1477
SHA-256:	E193DEBC2E98446448A6D3F98539CFDDAB6CB30E30C9E6276CB2BB0ACFD8C626
SHA-512:	F735ACFAD66AEC9AB20D2BD792B175F3076B8CEF2D2B460EB695598589E10B6D0B7305006736737DEEE4D0D902E0BABECB715F1C973986D6D533252D969014F1
Malicious:	false
Preview:	{.. "locale": "ca-es",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Inicia el Teams autom.ticament",.. "tray_do_not_auto_start_button_text": "No inicies el Teams autom.ticament",.. "tray_exit_button_text": "Ix",.. "tray_exit_multi_account_button_text": "Ix de tots els comptes",.. "tray_signout_button_text": "Tanca la sessi.",.. "tray_my_status_text": "El meu estat",.. "tray_get_logs_text": "Obt.n els registres",.. "tray_get_support_files_text": "Recopilaci. dels fitxers de suport",.. "tray_status_available_text": "Disponible",.. "tray_status_busy_text": "Ocupat",.. "tray_status_donotdisturb_text": "No molesteu",.. "tray_status_away_text": "Absent",.. "tray_status_berightback_text": "Torne de seguida",.. "tray_status_appearaway_text": "Mostra'm com a absent",.. "tray_status_resetstatus_text": "Restableix l'estat",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_te

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-ca-es.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27765
Entropy (8bit):	4.785786443752486
Encrypted:	false
SSDEEP:	768:AZu6/kfOYsLscGH5FxwNN3nuw0y8600E/OJwiUHRqDKJvdz0Y6oZtTvhNpYh/BC8:AZu6/kf3YGH5Fxw/30600E/OJwiUHRq1
MD5:	7A863935C1C96135722BFEC55CA535A5
SHA1:	675BAEE21C0AED82A8B8ECA52D3EC5FFFC4C8628
SHA-256:	9A020D2F5135E2FC4A3AFCEB4A4C90CF5CB0412FBA169822E1344D5A8AA4F979
SHA-512:	DFE3BBDBCE2266BB75C4893B8BBA86A27DEF3459BD11DAA331CB6F8473FF2FEBA5B66CE42F2A9B11C12030F5812CA360BFD16637F4ABA373B22A9B6705FF44AB
Malicious:	false
Preview:	{.. "locale": "ca-es",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Inicia el Teams autom.ticament",.. "tray_do_not_auto_start_button_text": "No inici.s el Teams autom.ticament",.. "tray_exit_button_text": "Surt",.. "tray_exit_multi_account_button_text": "Surt de tots els comptes",.. "tray_signout_button_text": "Tanca la sessi.",.. "tray_my_status_text": "El meu estat",.. "tray_get_logs_text": "Obt.n els registres",.. "tray_get_support_files_text": "Recopilaci. dels fitxers de suport",.. "tray_status_available_text": "Disponible",.. "tray_status_busy_text": "Ocupat",.. "tray_status_donotdisturb_text": "No molesteu",.. "tray_status_away_text": "Absent",.. "tray_status_berightback_text": "Torno de seguida",.. "tray_status_appearaway_text": "Apar.ixer com a Absent",.. "tray_status_resetstatus_text": "Restableix l'estat",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_con

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-cs-cz.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27338
Entropy (8bit):	5.047758861707128
Encrypted:	false
SSDEEP:	768:sZs/3AYstpPjVA8TaNvcB6H9BfCfIxjY1nPHsNJPbnW36gWGgDJ+BT:sZs4NpPj28ovcI9BfCfIxjY1nPHsNJPa
MD5:	493D4277408D64E9E7A3B7A527E5D548
SHA1:	39725B1EFD4F918EBAC1041C4C76B3D98254DEA9
SHA-256:	523FD3BA3A028D7AC20DC9C2F20BD2614A41D28460E8DF6C0EA319DD9FFA3494
SHA-512:	287BDB597301BA9F6372B0073A4C504034859C9440A72E43A0406FDD19846D24881238A4762B2321E2D17818A36D5EE3D767F7EBDA856C0C821B049CFC6893F6
Malicious:	false
Preview:	{.. "locale": "cs-cz",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Automaticky spou.t.t Teams",.. "tray_do_not_auto_start_button_text": "Nespou.t.t Teams automaticky",.. "tray_exit_button_text": "Ukon.it",.. "tray_exit_multi_account_button_text": "Ukon.it v.echny ..ty",.. "tray_signout_button_text": "Odhl.sit se",.. "tray_my_status_text": "M.j stav",.. "tray_get_logs_text": "Z.skat protokoly",.. "tray_get_support_files_text": "Shrom..dit podp.rn. soubory",.. "tray_status_available_text": "Online",.. "tray_status_busy_text": "Nem.m .as",.. "tray_status_donotdisturb_text": "Neru.it",.. "tray_status_away_text": "Pry.",.. "tray_status_berightback_text": "P.ijdu hned",.. "tray_status_appearaway_text": "Zobrazit jako pry.",.. "tray_status_resetstatus_text": "Obnovit stav",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Aplikace Microsoft Team

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-cy-gb.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26718
Entropy (8bit):	4.822677918501717
Encrypted:	false
SSDEEP:	768:QZpgVauUO+sgtB5eLFldTUITPDwqj44qpZfH/Ov7lNpNPo6TVt96b:QZpS+deLFPPDwqj44qpZfH/Ov7lNpNPU
MD5:	D5CAB560E5F2D3A220601087EFDE7CB3
SHA1:	2A0C9E2D48E6DF47BA41A16A475D0B2E50622590
SHA-256:	11A7C00E0307D8212ED61DF0FE906D717C6BDF2BE03DCB87A8808AC4E88A45C6
SHA-512:	3822E8C143D8AC5929E6FB3739BE747A6DF47F48B215835C3565164AD2E57E410239C22B5FEAF478D3D2AEACBDBC51BB90B3448B31B2C38421247AF70BED66FE
Malicious:	false
Preview:	{.. "locale": "cy-gb",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Cychwyn Teams yn awtomatig",.. "tray_do_not_auto_start_button_text": "Peidio cychwyn Teams yn awtomatig",.. "tray_exit_button_text": "Rhoi.r Gorau Iddi",.. "tray_exit_multi_account_button_text": "Gadael pob cyfrif",.. "tray_signout_button_text": "Allgofnodi",.. "tray_my_status_text": "Fy statws",.. "tray_get_logs_text": "N.l y logiau",.. "tray_get_support_files_text": "Casglu ffeiliau cymorth",.. "tray_status_available_text": "Ar gael",.. "tray_status_busy_text": "Yn brysur",.. "tray_status_donotdisturb_text": "Ddim ar gael",.. "tray_status_away_text": "Ddim yma",.. "tray_status_berightback_text": "N.l mewn munud",.. "tray_status_appearaway_text": "Ymddangos fel ddim yma",.. "tray_status_resetstatus_text": "Ailosod y statws",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Mae Microsoft Te

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-da-dk.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26179
Entropy (8bit):	4.789049367120409
Encrypted:	false
SSDEEP:	768:nZp94AFwnsRPuU9BZ5PbvYJqCdEJ04OqU4InUzlp3hVHj0NwN7Io:nZ/u0PbvYJqCdEJLrrInUzlp3hVHj0Ne
MD5:	84FBD0ABDC3EAC10F7A7F256C0727043
SHA1:	005D8F456A8041889D3E63D3F8F91FEE06176380
SHA-256:	3FBC754AA43B3C0FA3A87A7CF140FB3160FC768F20FED92D6C4F8ADFB712E2F9
SHA-512:	86E3B6C81EB215E7BE269F68403821BAA73ABDDBC48011E7ECBDE7C4955A8BDD9E0B5878D8DD05B9590EAAFE96277EB72DDF9B1846B44AF0AB0456071ECDD9CB
Malicious:	false
Preview:	{.. "locale": "da-dk",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Start Teams automatisk",.. "tray_do_not_auto_start_button_text": "Start ikke Teams automatisk",.. "tray_exit_button_text": "Afslut",.. "tray_exit_multi_account_button_text": "Afslut alle konti",.. "tray_signout_button_text": "Log af",.. "tray_my_status_text": "Min status",.. "tray_get_logs_text": "Hent logfiler",.. "tray_get_support_files_text": "Indsaml supportfiler",.. "tray_status_available_text": "Online",.. "tray_status_busy_text": "Optaget",.. "tray_status_donotdisturb_text": "Vil ikke forstyrres",.. "tray_status_away_text": "Ikke til stede",.. "tray_status_berightback_text": "Er straks tilbage",.. "tray_status_appearaway_text": "Vis som Ikke til stede",.. "tray_status_resetstatus_text": "Nulstil status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams k.rer stadig, og d

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-de-de.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28229
Entropy (8bit):	4.801436768930744
Encrypted:	false
SSDEEP:	768:PDZzPSYSvTlgIJsxg/AlxofL3B6PBTr/OywtXNbi75HEH9bpt+uAMv3bVGP1zEo:PDZzPRsTKAAlKfN6PBTr/OywtXNbi75b
MD5:	F0CB431FE6F4DF8AFE2EE0C8B13A9D9B
SHA1:	9D71BC1CFA9E4569FF958D09D087E58E72343444
SHA-256:	064C63E2071ECF277D61E9FC4214509E6FB57153B22E60251DC9F886CFC3AC61
SHA-512:	AEE07D4E4F92BF035779E0E00AE30064F5CE50232F01E25BF51B5B39C85CA6F92037E775A924E120E01F6696E88508E625C165FBAF319F2F503F5DB6DCADEDA0
Malicious:	false
Preview:	{.. "locale": "de-de",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams automatisch starten",.. "tray_do_not_auto_start_button_text": "Teams nicht automatisch starten",.. "tray_exit_button_text": "Beenden",.. "tray_exit_multi_account_button_text": "Beenden aller Konten",.. "tray_signout_button_text": "Abmelden",.. "tray_my_status_text": "Mein Status",.. "tray_get_logs_text": "Protokolle abrufen",.. "tray_get_support_files_text": "Supportdateien erfassen",.. "tray_status_available_text": "Verf.gbar",.. "tray_status_busy_text": "Besch.ftigt",.. "tray_status_donotdisturb_text": "Nicht st.ren",.. "tray_status_away_text": "Abwesend",.. "tray_status_berightback_text": "Bin gleich zur.ck",.. "tray_status_appearaway_text": "Als abwesend anzeigen",.. "tray_status_resetstatus_text": "Status zur.cksetzen",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-el-gr.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37949
Entropy (8bit):	5.174337795233927
Encrypted:	false
SSDEEP:	768:5Z4sg2gqn8p1YsnFmOWlbQt12a8+ccJIePh25M4xdotEOK8Qbh8zBuDxkR6I4ai0:5Z1g2g0nlbQT2a8ZcJjh25MQyEOK8Qbw
MD5:	3E0AC7460A6A7F4FC75870C3A39C844C
SHA1:	52AF89EA50BF7797D126CC491DFB20811D66F56E
SHA-256:	9F04D3633AD7B7B54F57CE80E7D63A4DA188C5FB2528DF4F137C795F65F13EF3
SHA-512:	B5D681188030B5B42E0B95F64BBCC415A3815E57A6F8FE85BA03ADB486F94D2A37C3CBBCE3288494F93414518B17C6E6D6372ABE161909E704BE69255BE18FFE
Malicious:	false
Preview:	{.. "locale": "el-gr",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "........ ........ ... Teams",.. "tray_do_not_auto_start_button_text": "..... ........ ........ ... Teams",.. "tray_exit_button_text": "......",.. "tray_exit_multi_account_button_text": "........... .... ... ...........",.. "tray_signout_button_text": "..........",.. "tray_my_status_text": ". ......... ...",.. "tray_get_logs_text": ".... ....... ..........",.. "tray_get_support_files_text": "....... ....... ...........",.. "tray_status_available_text": "..........-.",.. "tray_status_busy_text": ".............",.. "tray_status_donotdisturb_text": "... .........",.. "tray_status_away_text": ".....",.. "tray_status_berightback_text": "......... ......

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-en-au.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	22535
Entropy (8bit):	4.725357544221275
Encrypted:	false
SSDEEP:	384:UVk0Zh1BwbNhCsbdz3ysTieABpEQpyyilFB1w+vH1xLfM+1BWA1ZXhUsAiLf/BjU:+ZIhCsbdz3ysTieui1xLfM+1BWA1ZXh0
MD5:	E565995D6A82594E3FB5AF7DEA0CD30C
SHA1:	0257E9EBB7A1490C9994B2C0E76591C54926E1CD
SHA-256:	45567EC2432C645F47FBCE7920C1A5B9C461D8C51CAD20654C805C28253D402B
SHA-512:	AD12EA77A7D04EE96A94B6C35F31142B05C577749E56001E3D5AD723EA211F82A5612F0869C10F9942F09A1C02A0A6EDAAB6C65AE1D72D0DC5D041FA6A084FCA
Malicious:	false
Preview:	{.. "locale": "en-au",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Auto-start Teams",.. "tray_do_not_auto_start_button_text": "Do not auto-start Teams",.. "tray_exit_button_text": "Quit",.. "tray_exit_multi_account_button_text": "Quit all accounts",.. "tray_signout_button_text": "Sign out",.. "tray_my_status_text": "My status",.. "tray_get_logs_text": "Get logs",.. "tray_get_support_files_text": "Collect support files",.. "tray_status_available_text": "Available",.. "tray_status_busy_text": "Busy",.. "tray_status_donotdisturb_text": "Do not disturb",.. "tray_status_away_text": "Away",.. "tray_status_berightback_text": "Be right back",.. "tray_status_appearaway_text": "Appear away",.. "tray_status_resetstatus_text": "Reset status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams is still running and you will continue to receive notifications.",

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-en-gb.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25065
Entropy (8bit):	4.726407866473522
Encrypted:	false
SSDEEP:	768:oZfhCsbSz3ysTieuu1xLfM+1BWA1ZXhVZUsAiLf7J/BjV9QcLiB:oZXE3yAiG1xLfM+1BWA1ZXhVZUsAiLfe
MD5:	8FB72A8EC9200E7FCF4A178093AE7455
SHA1:	A033CC61CDCEB6ACAB32A824FBD08CDB164E704A
SHA-256:	BC6D0A968CE36BDDD6FDFBB74509B207DF52D23372E2DB790F53E959B18A9349
SHA-512:	3A5115DB6ADBF19FCF92523348E227BAE5E0FDB6ABA119E40F709FB92226E445EA363AC870162E591832A09C837A4C88B9B2414223BC7F306C547249FE8374B4
Malicious:	false
Preview:	{.. "locale": "en-us",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Auto-start Teams",.. "tray_do_not_auto_start_button_text": "Do not auto-start Teams",.. "tray_exit_button_text": "Quit",.. "tray_exit_multi_account_button_text": "Quit all accounts",.. "tray_signout_button_text": "Sign out",.. "tray_my_status_text": "My status",.. "tray_get_logs_text": "Get logs",.. "tray_get_support_files_text": "Collect support files",.. "tray_status_available_text": "Available",.. "tray_status_busy_text": "Busy",.. "tray_status_donotdisturb_text": "Do not disturb",.. "tray_status_away_text": "Away",.. "tray_status_berightback_text": "Be right back",.. "tray_status_appearaway_text": "Appear away",.. "tray_status_resetstatus_text": "Reset status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams is still running and you will continue to receive notifications.",

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-en-us.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	68807
Entropy (8bit):	4.694872873668982
Encrypted:	false
SSDEEP:	1536:XCY37boQmy2q343xOqascNgRF0PGOSqenF5SC1i9pXKPxViRpN6glK+5iEDayctd:XCY37bpT74zE2J
MD5:	6B2DE8E671982E2138B853CCCB701F7A
SHA1:	B0F0E579288B2E3C857C43FFC6864221F046009F
SHA-256:	C2F8BE54AA76F1B216D0FDE983631B8E0C0414A104DFE39FEDF595DD8F4414FC
SHA-512:	014AF2C29A6FB444964843A62D03571BD612EDA7A468F0FB74502BAFA015F5299E58A37A2D6B77283AD1FB90063F9C2B3F3F01B257B70A928181F31323E3403E
Malicious:	false
Preview:	{.. "locale": "en-us",.. "strings": {.. "ellipsis_text": "...",.. "_ellipsis_text.comment": "Text for ellipsis string",.. "tray_auto_start_button_text": "Auto-start Teams",.. "_tray_auto_start_button_text.comment": "Auto-start radio button text on tray submenu",.. "tray_do_not_auto_start_button_text": "Do not auto-start Teams",.. "_tray_do_not_auto_start_button_text.comment": "Do not auto-start radio button text on tray submenu",.. "tray_exit_button_text": "Quit",.. "_tray_exit_button_text.comment": "Quit button text on Tray icon",.. "tray_exit_multi_account_button_text": "Quit all accounts",.. "_tray_exit_multi_account_button_text.comment": "Quit button text on Tray icon for all accounts when there are more than 1 accounts",.. "tray_signout_button_text": "Sign out",.. "_tray_signout_button_text.comment": "Sign out (action) item text for system tray menu",.. "tray_my_status_text": "My status",.. "_tray_my_status_text.comment": "System tray me

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-es-es.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27532
Entropy (8bit):	4.733977803861928
Encrypted:	false
SSDEEP:	768:9ZeuET9sLOVYY1DAW2yA8medjqDolIr7IS+oUx4/ltmjZ2WlF:9ZeqKsW2yA8medjqDolIr7IS+oUx4/lm
MD5:	0589F4A823B083E93E68D750BD130894
SHA1:	3889B3743FA518197E68066D09F3F9948A4E8B5A
SHA-256:	6719D566030EE2084FA2A7FF80CE16DC9D6E5D034EA460E630267DA3676189B0
SHA-512:	37CC99A417002D26BDFB67FA00078A0A6D23E863F31E39654849A19440C0E1273959BF794C55BDED4F2B71A9F33299EB3C53A8227DD407982D6CA928AB49AD7E
Malicious:	false
Preview:	{.. "locale": "es-es",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Iniciar Teams autom.ticamente",.. "tray_do_not_auto_start_button_text": "No iniciar Teams autom.ticamente",.. "tray_exit_button_text": "Salir",.. "tray_exit_multi_account_button_text": "Salir de todas las cuentas",.. "tray_signout_button_text": "Cerrar sesi.n",.. "tray_my_status_text": "Mi estado",.. "tray_get_logs_text": "Obtener registros",.. "tray_get_support_files_text": "Recopilar archivos de soporte",.. "tray_status_available_text": "Disponible",.. "tray_status_busy_text": "Ocupado",.. "tray_status_donotdisturb_text": "No molestar",.. "tray_status_away_text": "Ausente",.. "tray_status_berightback_text": "Vuelvo enseguida",.. "tray_status_appearaway_text": "Aparecer como ausente",.. "tray_status_resetstatus_text": "Restablecer estado",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Mi

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-es-mx.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27501
Entropy (8bit):	4.7348605674199895
Encrypted:	false
SSDEEP:	768:wZLPnDQsSyVNe4gr0yA8medjqDe1+rAIS+oUx4+AtmjZGWvF:wZLdetr0yA8medjqDe1+rAIS+oUx4+Ac
MD5:	F27CFB9AB5025FD2AC63010D1CC8B928
SHA1:	C98AE2373B947272708DF496FB2B1D1418DBC59B
SHA-256:	2D3A3170ED35AEED85FDE0876DFE94A682EE5A7A7FB55138F4FFBA78E28A0D9D
SHA-512:	7FB71D5B257D140DB98730471216FB5AA75A95AE925E10531C43ACCB3AFEEC80AAEB060B8DB88D362002418E2748E54F73F225AE01C137B07D5A3FE942C4F009
Malicious:	false
Preview:	{.. "locale": "es-mx",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Iniciar Teams autom.ticamente",.. "tray_do_not_auto_start_button_text": "No iniciar Teams autom.ticamente",.. "tray_exit_button_text": "Salir",.. "tray_exit_multi_account_button_text": "Salir de todas las cuentas",.. "tray_signout_button_text": "Cerrar sesi.n",.. "tray_my_status_text": "Mi estado",.. "tray_get_logs_text": "Obtener registros",.. "tray_get_support_files_text": "Recopilar archivos de soporte",.. "tray_status_available_text": "Disponible",.. "tray_status_busy_text": "Ocupado",.. "tray_status_donotdisturb_text": "No molestar",.. "tray_status_away_text": "Ausente",.. "tray_status_berightback_text": "Vuelvo enseguida",.. "tray_status_appearaway_text": "Aparecer como ausente",.. "tray_status_resetstatus_text": "Restablecer estado",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Mi

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-et-ee.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26325
Entropy (8bit):	4.789681446057841
Encrypted:	false
SSDEEP:	768:ZZx7szs4EYXb656EP9Zfo9v9SMtzAVg1R7u5zktvXE6Z3/e:ZZub65dP9Zfo9v9SMtzAVg1R7u5zktvw
MD5:	8EEE6AD730582AD63EF24F3F1A1B6E15
SHA1:	D88EE6B68FF91340C43DCDAF6E2299617364C32E
SHA-256:	F0EBDE0E734AFB55329A300ABF3DBC13514E6B077012787582DDAC56453A5A30
SHA-512:	CCBB45E9C2B6E2151A50FB177E356DD585501CC6EBA36EACF927892E80106E747B23A06691D3CB7C5A03E1AF57A6A04B606C99E82326052A3AC4C7ECBB70E20A
Malicious:	false
Preview:	{.. "locale": "et-ee",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "K.ivita Teams automaatselt",.. "tray_do_not_auto_start_button_text": ".ra k.ivita Teamsi automaatselt",.. "tray_exit_button_text": "V.lju",.. "tray_exit_multi_account_button_text": "Peata k.ik kontod",.. "tray_signout_button_text": "Logi v.lja",.. "tray_my_status_text": "Minu olek",.. "tray_get_logs_text": "Too logid",.. "tray_get_support_files_text": "Kogu tugifaile",.. "tray_status_available_text": "Saadaval",.. "tray_status_busy_text": "H.ivatud",.. "tray_status_donotdisturb_text": "Mitte segada",.. "tray_status_away_text": "Eemal",.. "tray_status_berightback_text": "Tulen kohe tagasi",.. "tray_status_appearaway_text": "Kuva olek Eemal",.. "tray_status_resetstatus_text": "L.htesta olek",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams t..tab ja sa saad endiselt tea

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-eu-es.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26625
Entropy (8bit):	4.72073854812862
Encrypted:	false
SSDEEP:	768:gZCwqGPsDZ9PeibG15spXNyg4IxJRWEDrE+LEjWtPWYZdtSI9qSfu9y:gZCwCBeiCzspdyg4IxJRWEDrE+LEjWtV
MD5:	FB86F577CBC946ABC10A6C863786BC31
SHA1:	942CA05B17D00D89C652D53B4A1239345055B33C
SHA-256:	CBF04454EBCF606A4181B0BF1B5E6E8F4FDA6F8762371D9F14DD170D684F66B7
SHA-512:	60ECB5745C27097D7B9B5432890C7E6626D2908B94B4A1BF2CEEE61C1B9200B2AF66CC4AC90164E8C3CE304501CFE322B50D6BE5470CDC348198E9149BFA5A85
Malicious:	false
Preview:	{.. "locale": "eu-es",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Abiarazi automatikoki Teams",.. "tray_do_not_auto_start_button_text": "Ez abiarazi automatikoki Teams",.. "tray_exit_button_text": "Irten",.. "tray_exit_multi_account_button_text": "Kendu kontu guztiak",.. "tray_signout_button_text": "Itxi saioa",.. "tray_my_status_text": "Nire egoera",.. "tray_get_logs_text": "Lortu egunkariak",.. "tray_get_support_files_text": "Bildu laguntza-fitxategiak",.. "tray_status_available_text": "Libre",.. "tray_status_busy_text": "Lanpetuta",.. "tray_status_donotdisturb_text": "Ez molestatu",.. "tray_status_away_text": "Kanpoan",.. "tray_status_berightback_text": "Segituan nator",.. "tray_status_appearaway_text": "Agertu kanpoan banengo bezala",.. "tray_status_resetstatus_text": "Berrezarri egoera",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams ex

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-fi-fi.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27056
Entropy (8bit):	4.802776184179091
Encrypted:	false
SSDEEP:	768:mZ+pKbM1ZkmsBiqQP5SAe+WKwYj87OVjbOcKJABEeE8JAuei9fQdL:mZPbiqwSAe+WKwYj8q5KcKJABEeE8JAt
MD5:	E9F0767F782BFC411826D0F2579DB4D2
SHA1:	652E5476547C4261FEF1951DB85E85CF4D6DC4F8
SHA-256:	D63F20E946500654C1B5BF43BC70F2B8DE0DE063C2CC8A9546609C02D232CD2F
SHA-512:	B641A7A51CECBD50C38D28AFA0D446A1D891B0B4BACF7DD143C1A926AC545397F11CBA31896217FB2716795083D9E94C20CA6234AD83822B1E770512C4B5E97F
Malicious:	false
Preview:	{.. "locale": "fi-fi",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "K.ynnist. Teams automaattisesti",.. "tray_do_not_auto_start_button_text": ".l. k.ynnist. Teamsia automaattisesti",.. "tray_exit_button_text": "Lopeta",.. "tray_exit_multi_account_button_text": "Sulje kaikki tilit",.. "tray_signout_button_text": "Kirjaudu ulos",.. "tray_my_status_text": "Oma tila",.. "tray_get_logs_text": "Hae lokit",.. "tray_get_support_files_text": "Ker.. tukitiedostoja",.. "tray_status_available_text": "Tavoitettavissa",.. "tray_status_busy_text": "Varattu",.. "tray_status_donotdisturb_text": ".l. h.iritse",.. "tray_status_away_text": "Poistunut",.. "tray_status_berightback_text": "Palaan pian",.. "tray_status_appearaway_text": "N.y poistuneena",.. "tray_status_resetstatus_text": "Palauta tila",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams on k

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-fil-ph.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27296
Entropy (8bit):	4.704092620803426
Encrypted:	false
SSDEEP:	768:OZgXPUUsZgUzSwZao1DP5xLp8Ii0xkR6S3lpNpB1Zm9h9LuZ:OZlg3o1DP5xLp8Ii0xkR6S3lpNpB1Zme
MD5:	FC1129849EF0E1B4579564F06E141208
SHA1:	54F59AE1CB502C10C2DC73E16D0C17494D086903
SHA-256:	9FE86D3E26413FD471794A872475D767BB53C94B23402A7A7D321962D659F823
SHA-512:	4B6F4A29C69BCFE71716DFBA3B591BD988ECB8665EB1C23B219392C65597F587470D59FC5CF0BB181BFE6A8ABBC0630B45B6FFA41432FF3C4835105D771FB750
Malicious:	false
Preview:	{.. "locale": "fil-ph",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Awtomatikong simulan ang Teams",.. "tray_do_not_auto_start_button_text": "Huwag awtomatikong simulan ang Teams",.. "tray_exit_button_text": "Lumabas",.. "tray_exit_multi_account_button_text": "I-quit ang lahat ng account",.. "tray_signout_button_text": "Mag-sign out",.. "tray_my_status_text": "Ang aking katayuan",.. "tray_get_logs_text": "Makakuha ng ng mga log",.. "tray_get_support_files_text": "Kolektahin ang mga file ng suporta",.. "tray_status_available_text": "Available",.. "tray_status_busy_text": "Abala",.. "tray_status_donotdisturb_text": "Huwag istorbohin",.. "tray_status_away_text": "Umalis",.. "tray_status_berightback_text": "Babalik ako",.. "tray_status_appearaway_text": "Lumabas na umalis",.. "tray_status_resetstatus_text": "I-reset ang katayuan",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-fr-ca.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28476
Entropy (8bit):	4.818036781479407
Encrypted:	false
SSDEEP:	768:5Zq+WrsxTnEnLF5F4pOuo4n2Sk3YojIxvqr2kam/XQ9S6TvXloJ:5ZpTnCLJ4pOuo4n2Sk3YojIxvqr2kamL
MD5:	10155BA84D494F64892F12B1AEC0698F
SHA1:	BEBA38479CA371FE2CECF024F461D28E5DFBF452
SHA-256:	7DC63B6F69BB3A31F4EEC4C8285A2CBBD37C7F259CCB220C1ACE5DDAECC38849
SHA-512:	99EAC6EB041E239C1A8CB42F81FE12F047E3C71B7C65E6C24486278B05BF072D5CEB1CDF6D3B3D5CF098374C7F4EAA7F9F7329AA7978D7A8A66B7D3A165CFC52
Malicious:	false
Preview:	{.. "locale": "fr-fr",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "D.marrer automatiquement Teams",.. "tray_do_not_auto_start_button_text": "Ne pas d.marrer automatiquement Teams",.. "tray_exit_button_text": "Quitter",.. "tray_exit_multi_account_button_text": "Quitter tous les comptes",.. "tray_signout_button_text": "Se d.connecter",.. "tray_my_status_text": "Mon statut",.. "tray_get_logs_text": "Obtenir les journaux",.. "tray_get_support_files_text": "Collecter les fichiers de support",.. "tray_status_available_text": "Disponible",.. "tray_status_busy_text": "Occup.",.. "tray_status_donotdisturb_text": "Ne pas d.ranger",.. "tray_status_away_text": "Absent(e)",.. "tray_status_berightback_text": "De retour bient.t",.. "tray_status_appearaway_text": "Appara.tre absent",.. "tray_status_resetstatus_text": "R.initialiser l..tat",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_noti

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-fr-fr.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28566
Entropy (8bit):	4.818528937545654
Encrypted:	false
SSDEEP:	768:9Zd+WpsR1zE1t6gTTOuo4n2Sk3Ybr7xvqr2kam/Vg9S6T3XtQU:9ZA1z6tZTTOuo4n2Sk3Ybr7xvqr2kamU
MD5:	2D938326F38813DB0D863365A0FD0136
SHA1:	585D36F1792E989F3E748E3FBA784578AFC3B569
SHA-256:	2F90628C4003BFEC7B25E6867C4AF902CAF3F535C545ED7A31AFED5D3A788C45
SHA-512:	68680D57362F5ADC485CD3382AC8314BC92F9A64772DF33BEEB8CE47FFB21AED9286983E0D9A7C2DB104D29A94B0E02DC74D8300EB57269E2FCE188705BDFDD5
Malicious:	false
Preview:	{.. "locale": "fr-fr",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "D.marrer automatiquement Teams",.. "tray_do_not_auto_start_button_text": "Ne pas d.marrer automatiquement Teams",.. "tray_exit_button_text": "Quitter",.. "tray_exit_multi_account_button_text": "Quitter tous les comptes",.. "tray_signout_button_text": "Se d.connecter",.. "tray_my_status_text": "Mon statut",.. "tray_get_logs_text": "Obtenir les journaux",.. "tray_get_support_files_text": "Collecter les fichiers de support",.. "tray_status_available_text": "Disponible",.. "tray_status_busy_text": "Occup.",.. "tray_status_donotdisturb_text": "Ne pas d.ranger",.. "tray_status_away_text": "Absent(e)",.. "tray_status_berightback_text": "De retour bient.t",.. "tray_status_appearaway_text": "Appara.tre absent",.. "tray_status_resetstatus_text": "R.initialiser le statut",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_noti

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-gl-es.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26935
Entropy (8bit):	4.7403369764793855
Encrypted:	false
SSDEEP:	768:UZGH2OIsmGrFiU8W2L0SO4S9r0HCliFrgLleoTxQj49mv26UKSPH:UZGWRU8Ww0SO4S9r0HCliFrgLleoTxQi
MD5:	1D5F1C29A21E61D99F470E6F46D27D9C
SHA1:	F94537D05CE58B17EBEBD07013D50461439FE5E0
SHA-256:	C1ABC0DA2DF38094209F5194344B7CE288ED05E4469AB1F9916E676DE19C3914
SHA-512:	C4C3323D673B24ED71D909B737B7F43DC9EBBBD6B38287A6021459251BA4A330AA2E835958EC1F915AF41A2C511B0918EDF7EC130B3A762F389F87AC7E0F8A4A
Malicious:	false
Preview:	{.. "locale": "gl-es",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Iniciar Teams automaticamente",.. "tray_do_not_auto_start_button_text": "Non iniciar Teams automaticamente",.. "tray_exit_button_text": "Sa.r",.. "tray_exit_multi_account_button_text": "Sa.r de todas as contas",.. "tray_signout_button_text": "Pechar sesi.n",.. "tray_my_status_text": "O meu estado",.. "tray_get_logs_text": "Obter rexistros",.. "tray_get_support_files_text": "Recompilar ficheiros de compatibilidade",.. "tray_status_available_text": "Dispo.ible",.. "tray_status_busy_text": "Ocupado",.. "tray_status_donotdisturb_text": "Non molestar",.. "tray_status_away_text": "Ausente",.. "tray_status_berightback_text": "Volvo agora",.. "tray_status_appearaway_text": "Aparece ausente",.. "tray_status_resetstatus_text": "Restablecer estado",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Mic

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-he-il.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	29327
Entropy (8bit):	5.010882377482622
Encrypted:	false
SSDEEP:	768:lZNXes7p+sjknBwu7OGhFMoMWj9zSYF4fxYZv7PfAyS9Rd1IJq:lZ9eSBknfyGhFMoMWj9zSYF4fxYZv7Po
MD5:	D1C850243748060895826396403BD7BA
SHA1:	6F164C5BD92A193C6814C432FC7ECAF7A4BB2970
SHA-256:	C7FE38474E0B9CF8F5BBE143A0C6A7B63B462868D6E2A05420F05CDBACA812C5
SHA-512:	0E712B5006C0B556C4E62C4FC3435E7C0C514F3E1E83F8E8E1ABED42608D8657DD92ACAC12623CCC8B50E2CBD0F7540EAE6894B739E25B046500B1C8989661A7
Malicious:	false
Preview:	{.. "locale": "he-il",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": ".... .. Teams ..... .......",.. "tray_do_not_auto_start_button_text": ".. ..... .. Teams ..... .......",.. "tray_exit_button_text": ".....",.. "tray_exit_multi_account_button_text": ".. ... ........",.. "tray_signout_button_text": ".....",.. "tray_my_status_text": ".... ...",.. "tray_get_logs_text": "... ..... .....",.. "tray_get_support_files_text": ".... .... .....",.. "tray_status_available_text": "....",.. "tray_status_busy_text": "....",.. "tray_status_donotdisturb_text": ".. .. ......",.. "tray_status_away_text": ".. ....",.. "tray_status_berightback_text": "... ....",.. "tray_status_appearaway_text": "..... ... ....",.. "tray_status_resetstatus_text": "..... ...",.. "tray_notification_ti

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-hi-in.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	42204
Entropy (8bit):	4.875073356102878
Encrypted:	false
SSDEEP:	768:CZ1p0sMsQXG0HhecOpTCXk+NTOr4Ng9kw+64QSWs5MzpN6bBnzbFX9uZ1M6SQ:CZ17cXG0HhecOpTT+NTOr4Ng9kw+64Qh
MD5:	5B48CAA5D74BBDD34E7A6215E15BB330
SHA1:	150306DD6EE7C003876853AB83EEAF92D6071E86
SHA-256:	1452EEB850858E8582D0C3BAAF24A4A16A21A1553D2BF9F004B01BE5FE636044
SHA-512:	0594E3A976D7D5483D32C79053BCE769ABBBC77365290BB1A33E3A866F2B2D194B574CAB36C63B7A47114EC60A00D5DEBAC414EA18DD24D8A82DC44C319A51EF
Malicious:	false
Preview:	{.. "locale": "hi-in",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams .. ..... .... ....",.. "tray_do_not_auto_start_button_text": "Teams .. ..... .... . ....",.. "tray_exit_button_text": ".... ......",.. "tray_exit_multi_account_button_text": "... ..... .. .... ......",.. "tray_signout_button_text": ".... ... ....",.. "tray_my_status_text": ".... ......",.. "tray_get_logs_text": "... ....... ....",.. "tray_get_support_files_text": "...... ....... ........ ....",.. "tray_status_available_text": "......",.. "tray_status_busy_text": "......",.. "tray_status_donotdisturb_text": "...... . ....",.. "tray_status_away_text": "....

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-hr-hr.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26995
Entropy (8bit):	4.8490653489348565
Encrypted:	false
SSDEEP:	768:rZS3ljswzFNDp8RVO95cm3EsOm4tRNHNBuTnOowTuI94p6ex:rZS5T2G95cm3EsOm4tRNHNBuTnOowaIO
MD5:	AC0E047D63D0FD9A0409D55A9FD2098F
SHA1:	F473460AFFE9E79828A68576B9D3E1F2464E8BAC
SHA-256:	F08ED7227EBDF33ACFC1ED439E03B35537691178594D5536D953445E53AB634C
SHA-512:	335715CC7A250DE4D24CB0E871C05E0127F5208631753E1BC3F7AF78C9F103D7FB9A78BF2FC8637CB3DDC41B56047DA5F391481969544B8BD2F0B9D400DA1171
Malicious:	false
Preview:	{.. "locale": "hr",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Automatski pokre.i Teams",.. "tray_do_not_auto_start_button_text": "Nemoj automatski pokretati Teams",.. "tray_exit_button_text": "Zatvori",.. "tray_exit_multi_account_button_text": "Iza.i iz svih ra.una",.. "tray_signout_button_text": "Odjava",.. "tray_my_status_text": "Moj status",.. "tray_get_logs_text": "Dohvatite zapisnike",.. "tray_get_support_files_text": "Prikupljanje datoteka za podr.ku",.. "tray_status_available_text": "Dostupan",.. "tray_status_busy_text": "Zauzet",.. "tray_status_donotdisturb_text": "Ne ometaj",.. "tray_status_away_text": "Nisam tu",.. "tray_status_berightback_text": "Vra.am se odmah",.. "tray_status_appearaway_text": "Naizgled odsutan",.. "tray_status_resetstatus_text": "Vrati izvorni status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams jo.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-hu-hu.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28114
Entropy (8bit):	5.014739428347315
Encrypted:	false
SSDEEP:	768:kDZC54eQ6sgls//fJzXCiZLcl5K6gVJQfcJm5cE8IQyJkmwYKhiEMrnx606:kDZ862uJz/++6gVJQfcJm5cE8IQyJkmE
MD5:	7159F88309F214722BDC9CDC7B518CCF
SHA1:	D70264789F8B4BAE31B5DE2FE7A3CA8236AD06D8
SHA-256:	7DFE67C9FD5B6853FE820F6AB4E9D89364AD08401B5AA46E90B7AF69C64A3148
SHA-512:	94FA8B950C228E34B5DF11E7FE839D3C5F9CD7B16C5303F5EE60DB5694D7E2AD57140FB599337DD9C68C010AD448AE40DA67FA351A5BD844298D73536DE6C6C9
Malicious:	false
Preview:	{.. "locale": "hu-hu",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "A Teams automatikus ind.t.sa",.. "tray_do_not_auto_start_button_text": "Ne induljon el automatikusan a Teams",.. "tray_exit_button_text": "Kil.p.s",.. "tray_exit_multi_account_button_text": "Kil.p.s az .sszes fi.kb.l",.. "tray_signout_button_text": "Kijelentkez.s",.. "tray_my_status_text": "Saj.t .llapot",.. "tray_get_logs_text": "Napl.k lek.r.se",.. "tray_get_support_files_text": "T.mogat.si f.jlok .sszegy.jt.se",.. "tray_status_available_text": "El.rhet.",.. "tray_status_busy_text": "Elfoglalt",.. "tray_status_donotdisturb_text": "Ne zavarjanak",.. "tray_status_away_text": "T.vol",.. "tray_status_berightback_text": "R.gt.n j.v.k",.. "tray_status_appearaway_text": "L.tsz.lag t.vol",.. "tray_status_resetstatus_text": ".llapot alaphelyzetbe .ll.t.sa",.. "tray_notification_title_text": "Microsoft Teams",.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-id-id.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26338
Entropy (8bit):	4.7229321298975275
Encrypted:	false
SSDEEP:	768:QZWE5mSsqhxi+C9ETH2iY4UuHuERIlhFSDlDKbh9BVN4i/JJe80:QZDlwpETH2iY4UuHuERIlhFSDlDKbh9C
MD5:	D1489D76CBADCA73363D1969F591C289
SHA1:	39FE0B1CB53315963DADEAA6907FFD30F306225E
SHA-256:	D9D09726958933B7893B0BDF73C8C13B16EB6ADB59FEEE4DF0EF08A35AE3CA24
SHA-512:	C19D42C1B3DDFB0108651C786FF74FC8F7C2BB3CE52FFC156FC518676D10F2EF435AB78DFB3F15569080703F5B32EA08E41D253819D0D03188297B346B88646B
Malicious:	false
Preview:	{.. "locale": "id-id",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Mulai Teams secara otomatis",.. "tray_do_not_auto_start_button_text": "Jangan mulai Teams secara otomatis",.. "tray_exit_button_text": "Tutup",.. "tray_exit_multi_account_button_text": "Keluar dari semua akun",.. "tray_signout_button_text": "Keluar",.. "tray_my_status_text": "Status saya",.. "tray_get_logs_text": "Dapatkan log",.. "tray_get_support_files_text": "Kumpulkan file dukungan",.. "tray_status_available_text": "Online",.. "tray_status_busy_text": "Sibuk",.. "tray_status_donotdisturb_text": "Jangan ganggu",.. "tray_status_away_text": "Tidak di tempat",.. "tray_status_berightback_text": "Segera kembali",.. "tray_status_appearaway_text": "Terlihat tidak di tempat",.. "tray_status_resetstatus_text": "Atur ulang status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams masih

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-is-is.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26861
Entropy (8bit):	4.943809278037923
Encrypted:	false
SSDEEP:	768:ZZTf2sjXsu2qtOaLGNaBUyZfiGtSTyGFjhmQS+sAK9u9ur:ZZtX5LGNaBUyZfiGtSTyGFjhmQS+sAKZ
MD5:	C7B45479717557FEFE653090BA1B0556
SHA1:	14AA4B6689EEB84D51900731A262D831AFC852CF
SHA-256:	60A3C70A2A613A9C650234D040076B709AF21294E1A9DD919388FA86CAC0E688
SHA-512:	CAEF6AC614E35D77895FEFC1729E5B8EBE4B6848D414F0BC37CD8744DD4C1188BC139141A8B57D660AE41D197A361A42EBB95E0EC5DB6FAABBA203DF5EB52256
Malicious:	false
Preview:	{.. "locale": "is-is",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Sj.lfvirk opnun Teams",.. "tray_do_not_auto_start_button_text": "Ekki opna Teams sj.lfvirkt",.. "tray_exit_button_text": "H.tta",.. "tray_exit_multi_account_button_text": "Loka .llum reikningum",.. "tray_signout_button_text": "Skr. .t",.. "tray_my_status_text": "M.n sta.a",.. "tray_get_logs_text": "S.kja ann.la",.. "tray_get_support_files_text": "Safna stu.ningsskr.m",.. "tray_status_available_text": "Laus",.. "tray_status_busy_text": "Upptekin(n)",.. "tray_status_donotdisturb_text": ".n..i. ekki",.. "tray_status_away_text": "Fjarverandi",.. "tray_status_berightback_text": "Skrapp fr.",.. "tray_status_appearaway_text": "Vir.ast fjarverandi",.. "tray_status_resetstatus_text": "Endurstilla st..u",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams er enn . gangi

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-it-it.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27109
Entropy (8bit):	4.694641435688118
Encrypted:	false
SSDEEP:	768:cZG8+MBs8+43p3Lo46bzuLb/3izPQa3JOWuUWwO5lZ+qBESgrm0lC:cZG82453LdYzuLb/3izPQa3JOWuUWwOp
MD5:	6C6DAAE93C410B55651706F589991824
SHA1:	ACA9FCF9D4D11C43C9DAA37F13354BA9C5CAC6F3
SHA-256:	A798A3E6BB6A1735FA44B6ED3B64F66836888E37430929CBDBA6904E11326C62
SHA-512:	0AFDD69319AFC376399F014A2E78C553C56122536B15F48EE80AA63B07AB58A086CEE879534AC9A896A77858EC66A9105D2B049A1FD30727BF5FB237C7708741
Malicious:	false
Preview:	{.. "locale": "it-it",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Avvia automaticamente Teams",.. "tray_do_not_auto_start_button_text": "Non avviare automaticamente Teams",.. "tray_exit_button_text": "Esci",.. "tray_exit_multi_account_button_text": "Esci da tutti gli account",.. "tray_signout_button_text": "Disconnetti",.. "tray_my_status_text": "Stato personale",.. "tray_get_logs_text": "Ottieni log",.. "tray_get_support_files_text": "Raccogli file di supporto",.. "tray_status_available_text": "Disponibile",.. "tray_status_busy_text": "Non disponibile",.. "tray_status_donotdisturb_text": "Non disturbare",.. "tray_status_away_text": "Assente",.. "tray_status_berightback_text": "Torno subito",.. "tray_status_appearaway_text": "Risulta assente",.. "tray_status_resetstatus_text": "Reimposta stato",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-ja-jp.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	30020
Entropy (8bit):	5.685423447037384
Encrypted:	false
SSDEEP:	768:IxZX2J5xuOcs8Ve9MKAQRTw7FRW/dAVcmuewqOAsCuA7u6iOw7LNcZ9Djey:IxZmSe9MKAQxEFs/dAVcmuewqL1r7u69
MD5:	6B4645A0057AA7A356AB9A08BBACF538
SHA1:	45433D712402F2B09854F53E32643333585F049F
SHA-256:	42AEEFC1300E289DE8B7D012B8D478E491242E29D9E1BB9EA36F0BDB9005F165
SHA-512:	6A4E3A29FAECDA8BAEC3A22C06E100D81BE24796B58A7F7A020A2A8E91E8A9229142F162F4B423A41B6F31D0A644B1C123AE4F9169DC484BACB6C363203875B2
Malicious:	false
Preview:	{.. "locale": "ja-jp",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams .........",.. "tray_do_not_auto_start_button_text": "Teams ..........",.. "tray_exit_button_text": "..",.. "tray_exit_multi_account_button_text": "..............",.. "tray_signout_button_text": "......",.. "tray_my_status_text": "..",.. "tray_get_logs_text": ".....",.. "tray_get_support_files_text": ".... .......",.. "tray_status_available_text": "....",.. "tray_status_busy_text": ".....",.. "tray_status_donotdisturb_text": "....",.. "tray_status_away_text": "...",.. "tray_status_berightback_text": ".....",.. "tray_status_appearaway_text": ".....",.. "tray_status_resetstatus_text": ".......",.. "tray_notification_title_text": "Microsoft Teams",.. "

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-ka-ge.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	43731
Entropy (8bit):	4.652358119604537
Encrypted:	false
SSDEEP:	768:0ZdeIa8jYZzZFBsnf3Sdyl79gnv6eCWDXIhnJ09q8C1qYiG3hg+hLDHKumrHwPyF:0Zdw23Sv+WDi78CUYlpLDHKumrHwPDDO
MD5:	FB7FE33ACFDCF4B9D0999821280342F8
SHA1:	17B68D2816E5C191CA27C7E1D9406A9A6DF92E6C
SHA-256:	9A09D93C24D6FBBDFF001879D950F63178CACCBAE04C834B665EE1FCACACD1CA
SHA-512:	69DFA47303F7AB024B968E7958A72343FB6E8CC889BE9BA6B6134BEBA31BB27743831601CF8468AA9A6889CD07A1D038F019E26514F0A4BE92FB5A82A5F8BEE9
Malicious:	false
Preview:	{.. "locale": "ka",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams-.. .......... .......",.. "tray_do_not_auto_start_button_text": "Teams-.. .......... ........ ........",.. "tray_exit_button_text": ".......",.. "tray_exit_multi_account_button_text": "..... ........... ......",.. "tray_signout_button_text": "......",.. "tray_my_status_text": ".... .......",.. "tray_get_logs_text": ".......... ......",.. "tray_get_support_files_text": "........... ........ .........",.. "tray_status_available_text": ".............",.. "tray_status_busy_text": "..........",.. "tray_status_donotdisturb_text": ".. .

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-kk-kz.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35916
Entropy (8bit):	5.288866391198977
Encrypted:	false
SSDEEP:	768:gwSZ2IHX/39PeqiNsccesxa0N4Bjd7Bxtrupgp0jUIxPp5ben/x/9RoPOIJ3g:gwSZ2IH/poncesFNSjd7Bxtrupgp0jUv
MD5:	D8A9E38BA2F232308AAD79301B63D011
SHA1:	045D784B4EC810C540C982892C427019C2663E0C
SHA-256:	00E930EFB5AB7F32F95A445B9E1525E1CF0A5C462D31220117018EA260D92992
SHA-512:	B45F277C6D057A463F067557F528441752BE7CD02CD94560CD6670B14228A9A230105674C56DA8F99AA3FA548901EA5BCB3A346442ABA914C22C613895B9E664
Malicious:	false
Preview:	{.. "locale": "kk-kz",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams ............. ......... ..... .... ....",.. "tray_do_not_auto_start_button_text": "Teams ............. ......... ..... .... ......",.. "tray_exit_button_text": "....",.. "tray_exit_multi_account_button_text": "...... .............. ....",.. "tray_signout_button_text": "....",.. "tray_my_status_text": "..... .....",.. "tray_get_logs_text": "......... ...",.. "tray_get_support_files_text": "...... ....... ......... .....",.. "tray_status_available_text": "..........",.. "tray_status_busy_text": "... ....",.. "tray_status_donotdisturb_text": "...........",.. "tray_status_away_text": "....... ...",.. "tray_status_berightback_text": "....... .....

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-ko-kr.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27436
Entropy (8bit):	5.664107669069475
Encrypted:	false
SSDEEP:	768:HGZmUiMIgzsqLeCuWBOScNBvD9Po5Ew3tXrIKU7X+o5My957lV:mZPi0eCu/NBvD9Po5Ew3tXrIKU7X+o5J
MD5:	91B3D130AC9CFE2ABDD2C8D984468B29
SHA1:	41F49B78D4DD9D5DDCC34CD695CDF23CB699A34B
SHA-256:	BA590E7F5FCB2E239DA5C3AAE07255A87808E991893D74D392F6E7DB50B435C7
SHA-512:	C804FF23A683086F06A706C651A870175B48EA5FE8C567FFC139CAC79FDCBF1402E7F45C88BFE64D00BE9B1DCA38A56977730C60F2BB80A72168A6A2992F497F
Malicious:	false
Preview:	{.. "locale": "ko-kr",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams .. ..",.. "tray_do_not_auto_start_button_text": "Teams .. .. . .",.. "tray_exit_button_text": "..",.. "tray_exit_multi_account_button_text": ".. .. ..",.. "tray_signout_button_text": "....",.. "tray_my_status_text": ". ..",.. "tray_get_logs_text": ".. ....",.. "tray_get_support_files_text": ".. .. ..",.. "tray_status_available_text": ".. ..",.. "tray_status_busy_text": ".. .. .",.. "tray_status_donotdisturb_text": ".. ..",.. "tray_status_away_text": ".. ..",.. "tray_status_berightback_text": ". ....",.. "tray_status_appearaway_text": ".. .... ..",.. "tray_status_resetstatus_text": ".. ...",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsof

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-lt-lt.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27673
Entropy (8bit):	4.953809620378946
Encrypted:	false
SSDEEP:	768:RZuRMjjssKr2CSejTAI1qZUKMqznutZ3cllFtXSJ+WICCtX9lvkIhtHH+VS:RZwfr2rFUKMqznutZ3cllFtXSJ+WICCV
MD5:	9FE1ADEC5781DBFB9F4DC91F33E5D34F
SHA1:	A9E7C87BB5F2AA0D10925EFE7B10771AE024A3ED
SHA-256:	B829D98D94498A282B4304639321F4BAF494C7AD4EF71C39BE3C02AB2F4EDAD7
SHA-512:	8642DEFCE220C781B28FF6564935032E621C9BCFE498760C216EB67FC8928E5184EAB93C323D2C9CE7919384D6507BA2D611B90D9E37BE6CD4B821E0C387CB7F
Malicious:	false
Preview:	{.. "locale": "lt-lt",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Paleisti .Teams. automati.kai",.. "tray_do_not_auto_start_button_text": "Nepaleisti .Teams. automati.kai",.. "tray_exit_button_text": "I.eiti",.. "tray_exit_multi_account_button_text": "I.eiti i. vis. paskyr.",.. "tray_signout_button_text": "Atsijungti",.. "tray_my_status_text": "Mano b.sena",.. "tray_get_logs_text": "Gauti .urnalus",.. "tray_get_support_files_text": "Rinkti palaikymo failus",.. "tray_status_available_text": "Pasiekiamas",.. "tray_status_busy_text": "U.si.m.s",.. "tray_status_donotdisturb_text": "Netrukdyti",.. "tray_status_away_text": "Atsitrauk.s",.. "tray_status_berightback_text": "Netrukus gr..iu",.. "tray_status_appearaway_text": "Rodyti kaip atsitraukus.",.. "tray_status_resetstatus_text": "Gr..inti b.sen.",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_con

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-lv-lv.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27612
Entropy (8bit):	4.940692212013693
Encrypted:	false
SSDEEP:	768:NZNoITcsv7aw4IyussQh5Ifj8uNS44yQGZXErKNYeqN/Jjo8e1LAj8ejWVf:NZ0IgJ5INS44yQGZXErUT0/Jjo8e1LAM
MD5:	A61A6CC72B63AA9E4B57559503920A43
SHA1:	A051077ACAA51C0B164AB488811BFC6BCA531824
SHA-256:	D86780FAFF15F149BE0C8C6ED8166C1AC86D0CBAFA3882DC40D853409995F993
SHA-512:	89FF37B7FC8A5A9974D4C6D90BB43D85FF8924B66EB2ED62222C98890DECF90FEACEC097C0B4EA57A4050F2E71E9240BB95012A139C7E39E01DCF9956302DB9A
Malicious:	false
Preview:	{.. "locale": "lv-lv",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Autom.tiski start.t Teams",.. "tray_do_not_auto_start_button_text": "Nestart.t Teams autom.tiski",.. "tray_exit_button_text": "Iziet",.. "tray_exit_multi_account_button_text": "Iziet no visiem kontiem",.. "tray_signout_button_text": "Izrakst.ties",.. "tray_my_status_text": "Mans statuss",.. "tray_get_logs_text": "Ieg.t .urn.lus",.. "tray_get_support_files_text": "Apkopot atbalsta failus",.. "tray_status_available_text": "Pieejams",.. "tray_status_busy_text": "Aiz.emts",.. "tray_status_donotdisturb_text": "Netrauc.t",.. "tray_status_away_text": "Promb.tn.",.. "tray_status_berightback_text": "T.l.t atgriez.sies",.. "tray_status_appearaway_text": "Redzams k. promb.tn.",.. "tray_status_resetstatus_text": "Atiestat.t statusu",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Micro

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-mk-mk.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35084
Entropy (8bit):	5.084595367030588
Encrypted:	false
SSDEEP:	768:XZgMdNjd8LsWAVlOSRbbOwRp8wDAWzNuphJDqKMDLt3GY79WgcbL1H9:XZgMdpd+AVlOSdpRp8wDAWzNuphJDqKn
MD5:	7E3B1D18BBB4F21776FB2CE2BABB8A59
SHA1:	BBD34878554F81E28390557DD0849A22AFDE0842
SHA-256:	92F531529D614DDA3741B993334568C9D82ABAB46F03C65CCE023D5D0BA4100D
SHA-512:	52DE6558144DE3ACF42FC41E7734155B84E2F32C74A2ABEFB57E5DA4163A853C635B84672E2B997F957C39844B2BCBC64454A0A35883CD2833F93F9FA4B74272
Malicious:	false
Preview:	{.. "locale": "mk-mk",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": ".......... .......... .. Teams",.. "tray_do_not_auto_start_button_text": ".. .. ......... Teams ..........",.. "tray_exit_button_text": ".......",.. "tray_exit_multi_account_button_text": "...... .. .... ......",.. "tray_signout_button_text": "...... ..",.. "tray_my_status_text": "... ......",.. "tray_get_logs_text": ".... .. ..........",.. "tray_get_support_files_text": "........ ........ .. ........",.. "tray_status_available_text": "........",.. "tray_status_busy_text": ".......",.. "tray_status_donotdisturb_text": ".. ............",.. "tray_status_away_text": ".. ... ....",.. "tray_status_berightback_text": "...... .. ......",.. "tray_status_appearaway_text": ".

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-nb-no.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25707
Entropy (8bit):	4.7820352338850505
Encrypted:	false
SSDEEP:	768:vZ4FFRSisaXJFZV0JE2wKeonIEBNZ0pObUp7f8zoickjjgjKhvj70:vZ8JJ2wKeonIEBNZaQ67f8zoickjjgjl
MD5:	4F3851F743A9B0E21A6A1A4702FAF9C3
SHA1:	4F7CA5E04430EDF9B5BD672E55927A75CA0FFA9A
SHA-256:	E1318227A0E25F9A1B5843C9B13033C2A1DBD70CB42D99DFDC658048EDE2662B
SHA-512:	B8C8E700BD0E1468A873DFC8CF9742E3CC27173F3DB74776F9562E4A5CE65DAEDDDF3CDE7C876726734FB91A2FAEBE66C54F4D17B0FAB05C91B6BD5F34142F9E
Malicious:	false
Preview:	{.. "locale": "nb-no",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Start Teams automatisk",.. "tray_do_not_auto_start_button_text": "Ikke start Teams automatisk",.. "tray_exit_button_text": "Avslutt",.. "tray_exit_multi_account_button_text": "Avslutt alle kontoer",.. "tray_signout_button_text": "Logg av",.. "tray_my_status_text": "Min status",.. "tray_get_logs_text": "Hent logger",.. "tray_get_support_files_text": "Samle st.ttefiler",.. "tray_status_available_text": "Tilgjengelig",.. "tray_status_busy_text": "Opptatt",.. "tray_status_donotdisturb_text": "Ikke forstyrr",.. "tray_status_away_text": "Borte",.. "tray_status_berightback_text": "Straks tilbake",.. "tray_status_appearaway_text": "Vis som borte",.. "tray_status_resetstatus_text": "Tilbakestill status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams kj.rer fortsatt, og du vil fortsa

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-nl-nl.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26860
Entropy (8bit):	4.7038287170841
Encrypted:	false
SSDEEP:	768:NYZGRg+mQs1b1N/ZIXV0qTIG/eDABukB4hIsz2sqAMYIt9N1R5p:NYZEgJb1NxIBTIG/eDABukB4hIsz2sq9
MD5:	04854EF2F630C632E3D895503D9B31F5
SHA1:	164F410D8A213EFAEFE0903EA810E86458E984F8
SHA-256:	44A61E050A28F9E6C002671C12324D69331CF04884823965E764FF9B26F4624C
SHA-512:	3BBCCF98E6F1BEADC1388DA6717F362A518971DC14F819FE073EC6C967ACCD5B8B0875268C7636E0AF238609529398A6478716C1EFB0213F5B5D5CAA6E995419
Malicious:	false
Preview:	{.. "locale": "nl-nl",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams automatisch starten",.. "tray_do_not_auto_start_button_text": "Teams niet automatisch starten",.. "tray_exit_button_text": "Afsluiten",.. "tray_exit_multi_account_button_text": "Alle accounts sluiten",.. "tray_signout_button_text": "Afmelden",.. "tray_my_status_text": "Mijn status",.. "tray_get_logs_text": "Logboeken ophalen",.. "tray_get_support_files_text": "Ondersteuningsbestanden verzamelen",.. "tray_status_available_text": "Beschikbaar",.. "tray_status_busy_text": "Bezig",.. "tray_status_donotdisturb_text": "Niet storen",.. "tray_status_away_text": "Afwezig",.. "tray_status_berightback_text": "Zo terug",.. "tray_status_appearaway_text": "Als afwezig weergeven",.. "tray_status_resetstatus_text": "Status opnieuw instellen",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Tea

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-nn-no.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25823
Entropy (8bit):	4.7840703365190596
Encrypted:	false
SSDEEP:	768:TZgSJfI5sYoebIaSc2Om8yonIEBNZ62YKa2lo8zGcyYjU1jL9vfxEJ:TZgQjebbBm8yonIEBNZBnhlo8zGcyYjt
MD5:	C5489C5024652F403B9BA24629BC1399
SHA1:	92F8AEE3096A59629C0376011CEBA2840A59A6A9
SHA-256:	32BCC07D1D708CED6FD6F3B15AC7DB91B7201C2D32DDA48F1BC7E91B1FAD3ECD
SHA-512:	12DB6F0ED23C7B213390C61944656BF97125988BEB5BA2CB69A180B9EE70104146BFA8A1FEC57C89347F8730F5A0884510664C0922B2CC9AFFC23193BF4281C1
Malicious:	false
Preview:	{.. "locale": "nn-no",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Start Microsoft Teams automatisk",.. "tray_do_not_auto_start_button_text": "Ikkje start Microsoft Teams automatisk",.. "tray_exit_button_text": "Avslutt",.. "tray_exit_multi_account_button_text": "Avslutt alle kontoar",.. "tray_signout_button_text": "Logg av",.. "tray_my_status_text": "Min status",.. "tray_get_logs_text": "Hent loggar",.. "tray_get_support_files_text": "Samle inn filer fr. kundest.tte",.. "tray_status_available_text": "Tilgjengeleg",.. "tray_status_busy_text": "Oppteken",.. "tray_status_donotdisturb_text": "Ikkje forstyrr",.. "tray_status_away_text": "Borte",.. "tray_status_berightback_text": "Snart tilbake",.. "tray_status_appearaway_text": "Vis som borte",.. "tray_status_resetstatus_text": "Still tilbake status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Te

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-pl-pl.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27897
Entropy (8bit):	4.972382989400186
Encrypted:	false
SSDEEP:	768:2ZpI+sXSjTqdOy1oHPiPZBvr4Z5rZApAhLzAQjSQZ28bzXT:2ZljTBy1oHPiPZBvr4Z5rZApAhLzAQj7
MD5:	530E291A08049D4953E6CA0CB0340075
SHA1:	99740B66EF86831541505A23701E2C011200CC25
SHA-256:	6B0B6539B079D76AAA0812BA6E4E3D2F00BFE45046AAC51D4E58F17ED6E3FFD5
SHA-512:	1C967AEB4989D42C6755FFB187C05C9D3E99D329AE930174C4E5584B4D800E3B6D9F1A68A448FAE481BBDABA81E2C069924F9DCD0250A8FA7728850E78708EAA
Malicious:	false
Preview:	{.. "locale": "pl-pl",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Uruchom automatycznie aplikacj. Teams",.. "tray_do_not_auto_start_button_text": "Nie uruchamiaj automatycznie aplikacji Teams",.. "tray_exit_button_text": "Zako.cz",.. "tray_exit_multi_account_button_text": "Zamknij wszystkie konta",.. "tray_signout_button_text": "Wyloguj si.",.. "tray_my_status_text": "M.j status",.. "tray_get_logs_text": "Pobierz dzienniki",.. "tray_get_support_files_text": "Zbierz pliki pomocy technicznej",.. "tray_status_available_text": "Dost.pny",.. "tray_status_busy_text": "Zaj.ty",.. "tray_status_donotdisturb_text": "Nie przeszkadza.",.. "tray_status_away_text": "Z dala od urz.dzenia",.. "tray_status_berightback_text": "Zaraz wracam",.. "tray_status_appearaway_text": "Wy.wietlaj jako Z dala od komputera",.. "tray_status_resetstatus_text": "Resetuj status",.. "tray_notification_title_text": "Microsoft Tea

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-pseudo.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35541
Entropy (8bit):	5.446397053355783
Encrypted:	false
SSDEEP:	768:SJYvECvbn43DvXwzll7REnDPsPxyfltCnZJcT0GNYA9wXVHPPi2+st13JV+kb:SJYvEg+vXGSDPVfltCnZJcT0G2A9wXVN
MD5:	304805B0FC9B67CDD2362EA8153B78BF
SHA1:	9207AE0ABD42C3CB560F53F963A13E5B31A02DB9
SHA-256:	49D1346381A4F976321B335A1235A3B3A38DCCE39A6BAB2FF61715FCE24C0F4D
SHA-512:	521C40023760A9B65B2C62A6679895D396AB204C8D0EFE8AA310F74EEEC4332DCBD254F489F9B3B8DDF1E8F8E400E4686BE921734168276936A23BE682CAA563
Malicious:	false
Preview:	{. "locale": "pseudo",. "strings": {. "ellipsis_text": "[!!...!!]",. "tray_auto_start_button_text": "[!!....-..... ...m. !!]",. "tray_do_not_auto_start_button_text": "[!!.. ... ....-..... ...m. !!]",. "tray_exit_button_text": "[!!.... !!]",. "tray_exit_multi_account_button_text": "[!!.... ... ........ !!]",. "tray_signout_button_text": "[!!.... ... !!]",. "tray_my_status_text": "[!!M. ...... !!]",. "tray_get_logs_text": "[!!... .... !!]",. "tray_get_support_files_text": "[!!....... ....... ..... !!]",. "tray_status_available_text": "[!!.v....... !!]",. "tray_status_busy_text": "[!!.... !!]",. "tray_status_donotdisturb_text": "[!!.. ... ....... !!]",. "tray_status_away_text": "[!!.... !!]",. "tray_status_berightback_text": "[!!.. ..... .... !!]",. "tray_status_appearaway_text": "[!!...

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-pt-br.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26707
Entropy (8bit):	4.775875623556063
Encrypted:	false
SSDEEP:	768:zZICW14rsvcxOBNeaICUJKP3A6xGemKyqglJfjJ4v/9LrFsxH:zZICWOxWTICUJKP3A6xGemKyqglJfjJn
MD5:	1B9AF28FFC71D790076D467460308E7D
SHA1:	500F038DC06DA9002F8360FF914869067FD82723
SHA-256:	7A4E7796D7FA0C70DE4BDA3A2BC2FA3A6542981D23795AF35D19599FFA6A74C5
SHA-512:	F8CCE87C3046B5518400A1C7B866364C009C7D4C32CEEA3C82AB7ACC6B79CC878A0749D7F1B7D9C235A3248E2FE394B32E1F54A5CEE119B307F5E0D773EEA2A8
Malicious:	false
Preview:	{.. "locale": "pt-br",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Iniciar o Teams automaticamente",.. "tray_do_not_auto_start_button_text": "N.o iniciar o Teams automaticamente",.. "tray_exit_button_text": "Encerrar",.. "tray_exit_multi_account_button_text": "Sair de todas as contas",.. "tray_signout_button_text": "Sair",.. "tray_my_status_text": "Meu status",.. "tray_get_logs_text": "Obter logs",.. "tray_get_support_files_text": "Coletar arquivos de suporte",.. "tray_status_available_text": "Dispon.vel",.. "tray_status_busy_text": "Ocupado",.. "tray_status_donotdisturb_text": "N.o incomodar",.. "tray_status_away_text": "Ausente",.. "tray_status_berightback_text": "Volto logo",.. "tray_status_appearaway_text": "Aparecer como ausente",.. "tray_status_resetstatus_text": "Redefinir status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "O Microsoft Teams ai

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-pt-pt.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27216
Entropy (8bit):	4.780531314763251
Encrypted:	false
SSDEEP:	768:RZb3ZbEmKqGZspYa4Et+sUJLAPQs8cF8XeLxg6L0CpKpvqnDMajq:RZb3xERhatt+sUJLAPQs8cF8XeLxg6Ls
MD5:	6BCB2A23BE93DE52DD69E3F55F9858ED
SHA1:	223B9F04144E85D833149C858BE0FB8C5546964B
SHA-256:	EC30AC84CE43C722BA0FCC1606DE988B9D2B40E779D26E5AD45A263767E76C36
SHA-512:	C04C2A15C34A31E53ADA6D1035616C7B742CE5E01F3B034D363C53008CAE95B04E5BEDD1399F8AB1E984A4E8C7881046BDD9BD8EF6B8A4F6C48D3331E23072F7
Malicious:	false
Preview:	{.. "locale": "pt-pt",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Iniciar o Teams automaticamente",.. "tray_do_not_auto_start_button_text": "N.o iniciar o Teams automaticamente",.. "tray_exit_button_text": "Sair",.. "tray_exit_multi_account_button_text": "Sair de todas as contas",.. "tray_signout_button_text": "Terminar sess.o",.. "tray_my_status_text": "O meu estado",.. "tray_get_logs_text": "Obter registos",.. "tray_get_support_files_text": "Recolher ficheiros de apoio",.. "tray_status_available_text": "Dispon.vel",.. "tray_status_busy_text": "Ocupado(a)",.. "tray_status_donotdisturb_text": "N.o incomodar",.. "tray_status_away_text": "Ausente",.. "tray_status_berightback_text": "Volto j.",.. "tray_status_appearaway_text": "Aparecer como ausente",.. "tray_status_resetstatus_text": "Repor estado",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "O Micros

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-ro-ro.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	28030
Entropy (8bit):	4.855608689226464
Encrypted:	false
SSDEEP:	768:1Zoe96siUY3ZUK2jKE1HCqeOScN6tVxuVYWM2DDA3tWCnGhFFp:1ZXY3aKE1HCqeOScN6tVxuVYWM2DDytM
MD5:	3BBD3BA4B65603E9B84E02E5D4EC5B19
SHA1:	C6D7CA18546C8F4E5A379AE549C4B07C7D62F05A
SHA-256:	C36E723109840F55036DAE46431C9D158E4C97CBD0161AF49AE6A39F8504E7D9
SHA-512:	2581D118A4F5E92689FDDD2A9379BDA459FE598E25AD338ADC48AABF6677C89E03FCF3C23DA71D208BD6313ABC4320A1AD7E7B035E0847C3686A1A34BC8B557F
Malicious:	false
Preview:	{.. "locale": "ro-ro",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Porni.i automat Teams",.. "tray_do_not_auto_start_button_text": "Nu porni.i automat Teams",.. "tray_exit_button_text": "P.r.si.i",.. "tray_exit_multi_account_button_text": ".nchide.i toate conturile",.. "tray_signout_button_text": "Deconecta.i-v.",.. "tray_my_status_text": "Starea mea",.. "tray_get_logs_text": "Ob.ine.i jurnale",.. "tray_get_support_files_text": "Colecta.i fi.iere de suport",.. "tray_status_available_text": "Disponibil",.. "tray_status_busy_text": "Ocupat",.. "tray_status_donotdisturb_text": "Nu deranja.i",.. "tray_status_away_text": "Plecat",.. "tray_status_berightback_text": "Revin imediat",.. "tray_status_appearaway_text": "Afi.are ca plecat",.. "tray_status_resetstatus_text": "Reseta.i starea",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-ru-ru.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35545
Entropy (8bit):	5.177022839092741
Encrypted:	false
SSDEEP:	768:5EZGsQxrEtARsDGOLnY0pJz8v5qO9z3hysUYaZmKyZRPieL+P7J8wCSweaImgYOK:+ZuxUAgLnY0p188O9z3hyfYaZmKyZRP7
MD5:	7062BCDF6B85AC2D527810991DAA87C6
SHA1:	EFCFEF345DB459DA24743C4902CAE3E5411AD275
SHA-256:	760CC6AFD008CE1C067570E2EAE18E04FED9FDEBB3111E3673759CA4099A6885
SHA-512:	5FA4F40946437BB744B27F83CCA63A01BC4BB7E4647AF99A6C5743F7A45A13DE18BF63D3D1F42667B7FCCC5D838D2F08A5D5CF8767B446B5EBC71673518800AA
Malicious:	false
Preview:	{.. "locale": "ru-ru",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": ".......... Teams",.. "tray_do_not_auto_start_button_text": ".. ......... .......... Teams",.. "tray_exit_button_text": ".......",.. "tray_exit_multi_account_button_text": "..... .. .... ....... .......",.. "tray_signout_button_text": ".....",.. "tray_my_status_text": "... ......",.. "tray_get_logs_text": "....... .......",.. "tray_get_support_files_text": ".... ............... ......",.. "tray_status_available_text": ". ....",.. "tray_status_busy_text": ".....",.. "tray_status_donotdisturb_text": ".. ..........",.. "tray_status_away_text": "... .. .....",.. "tray_status_berightback_text": "..... .......",.. "tray_status_appearaway_text": ".......... ...... \"... ..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-sk-sk.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27794
Entropy (8bit):	5.012845129625841
Encrypted:	false
SSDEEP:	768:XZMEmMAVDmsPT5L+ZHs7gxBaV5dnJ4BXpFawV+oQhAF/lE1YuvjqTCdFY2oMZj0G:XZMEmpDF5aHsgcVCBpFawV+oQhAF/lE1
MD5:	AF57E3160EB1588C637D9342B1D4013B
SHA1:	4C8910441E776C43C20575F33B044A99B0327638
SHA-256:	C4A20E4BC69896C948DF9AA79AD1AF158CA05CA000F8AE78811B240A843FF246
SHA-512:	9208305E1EC960222D5B33B4B2C4DA363B10A49374EC6CA99B1CDE0F598E95B1B54ABF6B0494745E515F4B7E0F80F5F9A0055D8C82DA6E94147015EA1073F649
Malicious:	false
Preview:	{.. "locale": "sk-sk",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Automaticky sp...a. Teams",.. "tray_do_not_auto_start_button_text": "Nesp...a. Teams automaticky",.. "tray_exit_button_text": "Ukon.i.",.. "tray_exit_multi_account_button_text": "Ukon.i. v.etky kont.",.. "tray_signout_button_text": "Odhl.si. sa",.. "tray_my_status_text": "M.j stav",.. "tray_get_logs_text": "Z.ska. denn.ky",.. "tray_get_support_files_text": "Zhroma.di. podporn. s.bory",.. "tray_status_available_text": "K dispoz.cii",.. "tray_status_busy_text": "Nem.m .as",.. "tray_status_donotdisturb_text": "Neru.i.",.. "tray_status_away_text": "Som pre.",.. "tray_status_berightback_text": "Hne. sa vr.tim",.. "tray_status_appearaway_text": "Zobrazi. stav Som pre.",.. "tray_status_resetstatus_text": "Resetova. stav",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-sl-si.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27084
Entropy (8bit):	4.838059833496335
Encrypted:	false
SSDEEP:	768:i3ZJ0P6sLYraVCxqtlI/VxYS0fd5uS1iVf/n63/HOL8bNLHeIlN9dH:KZA2aCVVxYS0fd5uS1iVf/n63/Hk8bNX
MD5:	5F2F55FA835DBBE5612449CCC66AD552
SHA1:	0E41103A3DC24B854B3CFCBB79A6C547FC360E23
SHA-256:	B4EDFA3661ACB661C161D0F91E1AF467DF275768261E6B3134EE78D84B988E34
SHA-512:	6BDBE77F7E1B7D4D3C482A487DF55A662CE9A202C272E5C2B902D03E2539AF15AB165D12D18B775C5A26384B433947F0E2496CF5E46C3554180573D510342217
Malicious:	false
Preview:	{.. "locale": "sl-si",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Samodejno za.eni aplikacijo Teams",.. "tray_do_not_auto_start_button_text": "Ne za.eni samodejno aplikacije Teams",.. "tray_exit_button_text": "Zapri",.. "tray_exit_multi_account_button_text": "Zapri vse ra.une",.. "tray_signout_button_text": "Izpis",.. "tray_my_status_text": "Moje stanje",.. "tray_get_logs_text": "Prenos dnevnikov",.. "tray_get_support_files_text": "Zberi datoteke za podporo",.. "tray_status_available_text": "Dosegljiv/-a",.. "tray_status_busy_text": "Zaseden/-a",.. "tray_status_donotdisturb_text": "Ne motite",.. "tray_status_away_text": "Nisem prisoten/-na",.. "tray_status_berightback_text": "Takoj bom nazaj",.. "tray_status_appearaway_text": "Navidez nedosegljiv/-a",.. "tray_status_resetstatus_text": "Ponastavi stanje",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Mic

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-sq-al.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27269
Entropy (8bit):	4.8566031747099245
Encrypted:	false
SSDEEP:	768:eZopAOOsueD81zOXxLUWD4sSd0cmUk0FyMISIO2OJo9a0PgSB7ROSO:eZoHAzUxLUWD4sSd0cmUk0FyMISIO2O/
MD5:	1335929DAAFE885A1993EC6DD325FD21
SHA1:	FF4D14CDFCEB8E8670C2F2633A7F88B4AA2BEE5B
SHA-256:	4E7854BF9F447ADB090C27BC59021C95D7AF289AF6B12EDAD2078464D489AA04
SHA-512:	735EC5A9133578498E6CF7637D9727B5A49FE3D84AAE110A51FA7A3FF6D049FBEC9A70C024261D7CF2A55DA26224B957A7BCEA56B494B04379E83361D78F28D0
Malicious:	false
Preview:	{.. "locale": "sq-al",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Nis automatikisht Teams",.. "tray_do_not_auto_start_button_text": "Mos e nis automatikisht Teams",.. "tray_exit_button_text": "Dil",.. "tray_exit_multi_account_button_text": "Dil nga t. gjitha llogarit.",.. "tray_signout_button_text": "Dil",.. "tray_my_status_text": "Statusi im",.. "tray_get_logs_text": "Merr evidencat",.. "tray_get_support_files_text": "Mblidh skedar.t e mb.shtetjes",.. "tray_status_available_text": "N. dispozicion",.. "tray_status_busy_text": "I z.n.",.. "tray_status_donotdisturb_text": "Mos shqet.so",.. "tray_status_away_text": "Larg",.. "tray_status_berightback_text": "Kthehem shpejt",.. "tray_status_appearaway_text": "Nuk jam n. kompjuter",.. "tray_status_resetstatus_text": "Rivendos statusin",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams .sht

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-sr-latn-rs.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27020
Entropy (8bit):	4.840690412659313
Encrypted:	false
SSDEEP:	768:eZEXVsnsu5PWSzrOH8jdmr4bD7CUjm1d9lw6qL4fxl:eZmW5nzrOH8jdmr4bD7CUjm1d9lw6qLc
MD5:	EAADF5A1C93DFAD6A2B729D2EAE30AF8
SHA1:	64E64C6E803C8523DE8CA98157CC0B429B95B89C
SHA-256:	B78A9B2D613064EDA2E2CEE8CAA81E0D25DB26AE1FBC9777357E2DD2D6561D80
SHA-512:	B467DFD4F793FFD0C9FE81058E630EB12BC57E7E15519C9597A803637768F920177D4A424F6E4C9770453B04F651EE93B182F3AA6550A21BE5846132E93B4F9B
Malicious:	false
Preview:	{.. "locale": "sr-latn-rs",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Automatski pokreni Teams",.. "tray_do_not_auto_start_button_text": "Nemoj automatski da pokre.e. Teams",.. "tray_exit_button_text": "Odustani",.. "tray_exit_multi_account_button_text": "Iza.i sa svih naloga",.. "tray_signout_button_text": "Odjavite se",.. "tray_my_status_text": "Moj status",.. "tray_get_logs_text": "Pribavi evidencije",.. "tray_get_support_files_text": "Prikupi datoteke podr.ke",.. "tray_status_available_text": "Dostupan",.. "tray_status_busy_text": "Zauzet",.. "tray_status_donotdisturb_text": "Ne uznemiravaj",.. "tray_status_away_text": "Nisam tu",.. "tray_status_berightback_text": "Odmah se vra.am",.. "tray_status_appearaway_text": "Prika.i kao da nisam tu",.. "tray_status_resetstatus_text": "Resetuj status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Usluga

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-sv-se.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	26374
Entropy (8bit):	4.8128550341034435
Encrypted:	false
SSDEEP:	768:JOZZF1PcstR+kyRlXwyUYrDJ9avzcWcNptxfBENVNncBJjG9oFen1u2:wZrB+k4rDJ9avzcWcNptxfBENVNncBJc
MD5:	04F15B1B4937FADBE3C27DC795117DB5
SHA1:	C2FDD8E927DF0AEBFFB79491CDC18DDF23D77C72
SHA-256:	1217AA69A703CEB17408BD5DE366F9DEE8CF98A781E81EF9C760EC02858FA138
SHA-512:	F00DB9CB02C2EF4B70E76F852D8CAB9CBB3C7563B70B4611E12B4097B88C28CB44E099228AE414E53A9C15F4220D866A789D56D740A4E1B58AC60D4C2F2C14BE
Malicious:	false
Preview:	{.. "locale": "sv-se",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Starta Teams automatiskt",.. "tray_do_not_auto_start_button_text": "Starta inte Teams automatiskt",.. "tray_exit_button_text": "Avsluta",.. "tray_exit_multi_account_button_text": "Avsluta alla konton",.. "tray_signout_button_text": "Logga ut",.. "tray_my_status_text": "Min status",.. "tray_get_logs_text": "H.mta loggar",.. "tray_get_support_files_text": "Samla supportfiler",.. "tray_status_available_text": "Tillg.nglig",.. "tray_status_busy_text": "Upptagen",.. "tray_status_donotdisturb_text": "St.r ej",.. "tray_status_away_text": "Tillf.lligt borta",.. "tray_status_berightback_text": "Strax tillbaka",.. "tray_status_appearaway_text": "Visa som borta",.. "tray_status_resetstatus_text": ".terst.ll status",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams k.rs fortfarande o

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-th-th.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	41657
Entropy (8bit):	4.912601302729211
Encrypted:	false
SSDEEP:	768:baIZFr0NGS6th9i+9TSVzbQHuzAO1sVWHguXIiUKqc11vBA9/2HyNEPuN+e7nxIW:JZvlpvRF5RJ1nS4AkfdO97PTOrT7ufat
MD5:	6B9CC351D2E5E44F8ECF02A891F866E2
SHA1:	D60F12124D5EDF3CA6BB7F3D42C9E32F0D2FE6EE
SHA-256:	5C013A6E332FA94BD60EEECB1CF2498DC587EDCB3239DB1650FF65B6A8E5F16C
SHA-512:	FD7194B5470F96BF6AA9DA312011E723CF83C3BB66597DB1BE9CE4FC0172848FDABAFFFC83F089CDB9C7D47EB2B485677BA9C511E222656729A285649A988FB4
Malicious:	false
Preview:	{.. "locale": "th-th",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "........ Teams ............",.. "tray_do_not_auto_start_button_text": "............ Teams ............",.. "tray_exit_button_text": "..........",.. "tray_exit_multi_account_button_text": "..................",.. "tray_signout_button_text": ".........",.. "tray_my_status_text": "...........",.. "tray_get_logs_text": "...............",.. "tray_get_support_files_text": "..................",.. "tray_status_available_text": "....",.. "tray_status_busy_text": ".......",.. "tray_status_donotdisturb_text": ".........",.. "tray_status_away_text": ".......",..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-tr-tr.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	27106
Entropy (8bit):	4.976782684688227
Encrypted:	false
SSDEEP:	768:zZLGILwUKHqdQsi8n5IiH2BB1gxpb9nr148birGJmMJVDHl3dof69tSI2JB:zZV5ItBUb9nr148birGJmMJVDHl3doff
MD5:	A7AB18FCB9076BA13DE554DB3AC7CE04
SHA1:	3D05AE2D5D5F27816B51C03C4EFA56C20D5F3D41
SHA-256:	CF60D0E30BA0586B2DB1009E02202EE3C8C1540EA9896040A2B117820E87623C
SHA-512:	6C80A95C7142F015697D03BA020C402504233501EA54F26350135A2018E723AD418991E2A6D716055D100DD5A6C3B606CC83AB5C8EEB49A10D5A205D9E4594B3
Malicious:	false
Preview:	{.. "locale": "tr-tr",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "Teams'i otomatik olarak ba.lat",.. "tray_do_not_auto_start_button_text": "Teams'i otomatik olarak ba.latma",.. "tray_exit_button_text": "..k",.. "tray_exit_multi_account_button_text": "T.m hesaplardan ..k",.. "tray_signout_button_text": "Oturumu kapat",.. "tray_my_status_text": "Durumum",.. "tray_get_logs_text": "G.nl.kleri al",.. "tray_get_support_files_text": "Destek dosyalar.n. topla",.. "tray_status_available_text": "Uygun",.. "tray_status_busy_text": "Me.gul",.. "tray_status_donotdisturb_text": "Rahats.z etmeyin",.. "tray_status_away_text": "D..ar.da",.. "tray_status_berightback_text": "Hemen d.nece.im",.. "tray_status_appearaway_text": "D..ar.da g.r.n",.. "tray_status_resetstatus_text": "Durumu s.f.rla",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft T

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-uk-ua.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	35050
Entropy (8bit):	5.208797404465683
Encrypted:	false
SSDEEP:	768:jZMzNostnUYvbMi6iwbDEVDqj0RbP3rlnLzKPZRWth:jZMnnZvbMi6iwbDEVDqj0RbP3rlnLzKG
MD5:	F337B80C5AFCF9EE09B7AC9D39F3DAA9
SHA1:	A67DF5CF7EB8DC3EF1ECE12C89F3024D400B8C9A
SHA-256:	2DF35A178871AB195C38FF83D2FDEA9B84E918931DC002C5414C164F4788E73D
SHA-512:	FCC2C85151E55199D3F39BA7F80E015A8E191B575A43652F08144F2B7221D74AB9C245D26090CCE27CBB3C116188E89D965B93A0DF0A0EA36CD33881D23F4ABC
Malicious:	false
Preview:	{.. "locale": "uk-ua",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "......... .......... Teams",.. "tray_do_not_auto_start_button_text": "........ .......... Teams",.. "tray_exit_button_text": ".......",.. "tray_exit_multi_account_button_text": "..... . .... ......... .......",.. "tray_signout_button_text": ".....",.. "tray_my_status_text": "... ....",.. "tray_get_logs_text": "........ .......",.. "tray_get_support_files_text": "....... ..... .........",.. "tray_status_available_text": ".........",.. "tray_status_busy_text": "........",.. "tray_status_donotdisturb_text": ".. .........",.. "tray_status_away_text": ".. .. .....",.. "tray_status_berightback_text": "..... .........",.. "tray_status_appearaway_text": ".. .. .....",.. "tr

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-vi-vn.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	29889
Entropy (8bit):	5.288559683886251
Encrypted:	false
SSDEEP:	768:i7ZXAqXUJjKl80shirZartV4mQqfQlPF8pOJnxFvVuB99RDD63UYD4jfyIOHbnpX:i7ZXAqXUNE8NirZetV4mQqfQlPmgnxFV
MD5:	731AB99C5D3B41E66DB11FC1D3A6301C
SHA1:	8D8D445710ACA024805D73AD0802D0CEFA1803E7
SHA-256:	B6EEE5052DF0E2473944082C8FE3828F57EBE5A11E6725851E1EE175AC4E5AB9
SHA-512:	A554BA994873533AA3FE6E0205A4C2DF1ED60F576CEB2948E1ECCF0BF3B1A35060E6C7D2253285923F60854F8706132A256231E147148CDF0DB1ADDE81B1E6B9
Malicious:	false
Preview:	{.. "locale": "vi-vn",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": "T. ..ng kh.i ..ng Teams",.. "tray_do_not_auto_start_button_text": "Kh.ng t. ..ng kh.i ..ng Teams",.. "tray_exit_button_text": "Tho.t",.. "tray_exit_multi_account_button_text": "Tho.t t.t c. c.c t.i kho.n",.. "tray_signout_button_text": "..ng xu.t",.. "tray_my_status_text": "Tra.ng tha.i cu.a t.i",.. "tray_get_logs_text": "T.i nh.t k.",.. "tray_get_support_files_text": "Thu th.p c.c t.p h. tr.",.. "tray_status_available_text": "Tr.c tuy.n",.. "tray_status_busy_text": "B.n",.. "tray_status_donotdisturb_text": "..ng l.m phi.n",.. "tray_status_away_text": "V.ng m.t",.. "tray_status_berightback_text": "Quay l.i ngay",.. "tray_status_appearaway_text": "Hi.n th. l. v.ng m.t",.. "tray_status_resetstatus_text": "...t la.i tra.ng tha.i",.. "tray_notification_titl

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-zh-cn.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	24742
Entropy (8bit):	5.813481044505096
Encrypted:	false
SSDEEP:	768:w86ZWCpWVYQnBseFiGSjOGSl1ZCku+NigjViUJChb0l6F5mBQ6OYKply9o+2DYZ:AZPuDLxCk/NigjViUJCV0l6F5mBQ6OYz
MD5:	8D9D81030AD5C8ECCA31EA7BDABA3D0F
SHA1:	D1207D638478C808094573AD0C28C85F9E0F1373
SHA-256:	52552F40C0E2962C970A126302C4039B59A82C7FFC0EE7B12A0FA1927CAB2286
SHA-512:	53D139899E461E01EE364F840D27D65AB5A26C8FC4BD19B2ED1F9E34E0276A260A7254CB7E75B763D240C4057B4C500326A6C513A1CCCC9C0559E5E4B9E67F30
Malicious:	false
Preview:	{.. "locale": "zh-cn",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": ".... Teams",.. "tray_do_not_auto_start_button_text": "....... Teams",.. "tray_exit_button_text": "..",.. "tray_exit_multi_account_button_text": ".......",.. "tray_signout_button_text": "..",.. "tray_my_status_text": "....",.. "tray_get_logs_text": "....",.. "tray_get_support_files_text": "......",.. "tray_status_available_text": "..",.. "tray_status_busy_text": "..",.. "tray_status_donotdisturb_text": "....",.. "tray_status_away_text": "..",.. "tray_status_berightback_text": "....",.. "tray_status_appearaway_text": ".....",.. "tray_status_resetstatus_text": "....",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams ..............",..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\locales\locale-zh-tw.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	25136
Entropy (8bit):	5.83573922064041
Encrypted:	false
SSDEEP:	768:esZQAkeQ+EmtFs8ZuQkKX7Fu5QU31QJ42yzsXWqiMKAH0Jtp6dQZsRydvPEGtu9d:VZZkeQ+cQVrMiyzsXWqiMKAH0Jtp6dQi
MD5:	BF1FC49818300FF93E2F1D3A7B10C8D0
SHA1:	9CAA4D01BFEF61FD840ED907DE46C12C27F276EE
SHA-256:	D2A9C62F0E318D1784BA6DB7911883C7E88362F99CA4E1F132613AA4D840490B
SHA-512:	AB9C1F9FE7FD6DCC75A7888AF8246740C2DFB5AC8CFEE0E261CF163840DD9BC017C0E94D67A8DCA6B0C43DC6DCEFB1546131EB3EBD19521AF9B620659F76B07A
Malicious:	false
Preview:	{.. "locale": "zh-tw",.. "strings": {.. "ellipsis_text": "...",.. "tray_auto_start_button_text": ".... Teams",.. "tray_do_not_auto_start_button_text": "...... Teams",.. "tray_exit_button_text": "..",.. "tray_exit_multi_account_button_text": "......",.. "tray_signout_button_text": "..",.. "tray_my_status_text": "....",.. "tray_get_logs_text": ".....",.. "tray_get_support_files_text": "......",.. "tray_status_available_text": "..",.. "tray_status_busy_text": "..",.. "tray_status_donotdisturb_text": "....",.. "tray_status_away_text": "..",.. "tray_status_berightback_text": "....",.. "tray_status_appearaway_text": ".....",.. "tray_status_resetstatus_text": "....",.. "tray_notification_title_text": "Microsoft Teams",.. "tray_notification_content_text": "Microsoft Teams ................",..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\AddinInstaller.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33864
Entropy (8bit):	6.6749170427672215
Encrypted:	false
SSDEEP:	768:bgYy+J05SY3wauWD5Epw9z9gElzEpw9zT:FMcYgauA5Ep4z9ZzEp4zT
MD5:	7F17A972A3F083FC309E93C9ADA8AA10
SHA1:	0072330558FB6E91FE6801DE71ACF06A716BBA5C
SHA-256:	98B6CD35884C8AE37F33196A132D0029100C0BA8AD2EE0C084A4870CFA832214
SHA-512:	D2B924E1BCD5EB260B17CB58E527E87D6FA9E772088F95DF6369599D7C4FFA3866F83D35F6AB333667C129FA8AE9CEE781A46FE8781B37906A60AFC301EC48CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....q..........." ..0..............L... ...`....... ...............................6....`..................................L..O....`...............6..HN...........K..8............................................ ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............4..............@..B.................L......H.......\)..."...........................................................0..y........(......(.....(......(....-..(....&.(....(....,C.(....s....o.... .. .j1+.(....r...p(......(....,..(.....(.....(......&.............ou........{...."..}........0..D........(.....s.....(.......r...p(....r?..p.(.......o.......,..o ......&..........'4..........@@.......0..^..........&...%..\.%../.}.....(!....(.....s"...%rC..p.o#...%rI..p.o#...}.....(.......s....}......&..*........E..Z.......0..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Assets\NewMeeting_Large_120.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	7.73830447681088
Encrypted:	false
SSDEEP:	24:+5DjKVMPFXHX5S4wKHWKWZGmy/xRftEircOiO8UN7O3:+5i8HplNRmKtFPPo
MD5:	E3B1BA3900BFFAE493B4463F9A6FBC48
SHA1:	0BDDCAB7F9537F01900CB7A7AB0FBB1042E460E7
SHA-256:	8FDE3D7378D0E9148068C3A9406D5BD754E93C9810FF5D2B8535FC2B65E0830E
SHA-512:	8CA0A6304BD871B1F2BECCF6AF9CBB2EC97D05B233B9388CFC760B262509B8BF6F9B50B837D21018FCA6E8627FA11AE67F6AF49440A837701B4C9AE920585246
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....sRGB.........IDATX..W[h.A..w.5..4.-..PA....(>@k.\|..._.OA.k1.X........-..a.(..?.)...........hv.w..fw.... .Xf.>..s...@......z...........;%I:.9V.....B.>.;.$.@d.C@.%...W4.K.......).#.....I..u.Fr........8.8....z...UQ......$Y..R.n..#....L.9{.&M.h.6...P"zUQ...a....:.D..Nr.[.u...L.>....K."..'..t/..Yz....--...M.]...e..0.l....!.r./)r.].t..U!.l&...;....i.,I.TD.H......).S...D..P...sV4!.......K.r.\|...... ....Q^.5P.VI...`'.........`...S.Z......?............`......9....g..[.i..Z.\:#.T......2t).b.........Y..<.T...u.`...... \..nL.f.....3A....'7..zDi-....r].k/Hfk....b:......@.k...,D.k...#.j..Z....@<...}2.a:$...Q.vL..u...o.Z..\|I.r?.o.;..".8..{~'.l..fG3...x...W...%V.....h...!.;...gA.$.?F.w..Y...1!..yu.].....fW..>..w..).55b....D7..}.?...._...=.....".+..N.\Z.mup..p..d\y...r+........:..G.Q.S....>..9..[.L.@\|.:..qMP8E.B......R7;....Pk..F.......s...N..F@.B.G...0...e.:....T....d_....i:.........5....].sa^.@!..#....'.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Assets\NewMeeting_Large_144.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1237
Entropy (8bit):	7.788008184019191
Encrypted:	false
SSDEEP:	24:GVwVpPtyAjoNiCkbbtwi0G1UA9WdK+oJgsQ6QVdAmwQATjZWwrpFbVD3r:E6FjowPv70tB/oJgl6Q8mXAT1XLr
MD5:	6974CFC337BF190D728C6824EF94AFB6
SHA1:	741DABA13F01C19518E2E1E72A93DF2C96227934
SHA-256:	115340C0940669C7A55670F03737492FB86D5E34E0390E5664EEA3F9B4147B0C
SHA-512:	679AFA5D417748680624314A6E5FF63CBF37D11BF5E95FD2D2114076F1DCD75196849EB39B1D456A8A5DB0019EF2C4C2FD61EA70651DAF158B87A69D8B017FAF
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........IDATh..YOlTE..f.n....Hl].' ..(.1.......$...&....4.&..=.@..A{C...`0.....$.@cz......m....7~....7......%....}...o...H.$.Ow..r..9'.CS...G.{.j...@F..3_.Bx\vc.`xx....g0..&'...m...\...(F...$/2...+.[..%y.(.A......sZ..Z...._.2..V......."[...SB.Y}....%eUV..@...V......G...8.Q....3..}...+.Rq...`]...\.U..yL.V.<.Z.{.1..5P/".&H...5.....D..x.:..m.b.....l..Gl..S.y....."...k.....cX{i.p..pFHtV.8..)....Y...,;U....O,XQ......,.Z.Eq.V7....B.0..b.......Bs.....Z.........}..wp....E......U.......F..........av.#.!.../.......b..rG....E...ZV..W..]w...\..~.q.f.#...K(.2..bU/.L/.b..7?.....6Cg.y.{.R.......9.O..n..H....tYb....ZR.<.t)-c..t..... ..x../....;..D..k..D.....`.J3.d...m..d.LYi&..@3.-l......z.pE.T..Z.u..R..."P.(T......7.%.... ...9.%.....O..p..5..bQ.F..o.u.o.2.B.....l/...1.8-..e....B......\|P.E....vZZ;.Pj...b)..z..r3..s~../B..k6}Z+.."V..[.......T.D.jAU.n1.%f3:.Y..s.{..*..`I.$.....w..T.H...?..:X..OQ...b.N...

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Assets\NewMeeting_Large_192.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	7.805621612269991
Encrypted:	false
SSDEEP:	24:xyPSt6BuLqrVii+xXSCLqmgDvjUEAkgoX1Amyz/zaY6pGtqPgmeAkG0ZZz:cPSt6G2iimqm+6kgDl/t6iEfGz
MD5:	177094A528723CEF49FA2FFDFAB57CF5
SHA1:	CBAE150EDCD83F2E9BB87A0BB86CF076EEBC41C2
SHA-256:	66CD5E3CFC69AF5087D33C570CFE424B50935B01C27E618CA11822AC7AE6D1E6
SHA-512:	AD9394116D2E132EB2BFF48F1AE4AB7AEC5B372FFD2B7B41E29CD8BF26C87725BB48D0C3AD85F7C3C94B4556872A06876D1E95F4AD8A0CF63DD949DBE350D8E8
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........IDATx..Z]L.U.>..,.. .[)6<..b41.`..4M.>h..........&.H.l.Y_L..6..&ZiS./.'1....X...F)....dw.z.....30..:7......9.g..@.........n_..V.........]...9F9.?..2C6...u.h.#.....?..19...U&....P.@_.R.#FY..&....P2~.....~..J..(../...I .y..Q.R3....Q.y....a...8)cwv^.-...?..6s....\|....'Z.e:.4_..w....).Uz./\..........pG......N<...1.;..X.XO...a.../.OS.._.).... ..e...dz........\././...u^..-Q.'..R..D.l...._1.5..G. ...t=,a..Bbz.+$J.BNB...V.&7.3....&,..Y..u..0w....}.......v?wv....TF-vN..&&f,..\.#5.....6=..p....y{3...m1....X.(.-VjqO..S..u.x...e..,......3p..."..`..@..0U.d.Le.,......\|.....A.d.f>.......m.....{..T L......kD>.....K.....4Qv....J=...o;[...4d. .....O.S_...I.y.....Q.\..><.....8......r.T.?3.eK.......b..~.@9.....ll......Pkyh...n,m..o.\..&.ai)YJ>E.......I......rWG.tu..ftl.^..R...O.Euu%.....&&K.......Hp.Lx.......K....cE.,a..`.1....i.h.5..!.......7......u.OP.n.[o.A...;.6....".&..o..v.4(34tj......U...C...u...S.N....H.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Assets\NewMeeting_Large_96.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.630755600269692
Encrypted:	false
SSDEEP:	24:L9IW0j2BjoUb25MCbt+OzOGKynRHS/0psG7:LaW0l2Ut+ONRy8+G7
MD5:	FAFBA571265B20E0EC4423FEAD972E1B
SHA1:	B686D74FF48E3B990F0E312BB0F3AF4E8F53069A
SHA-256:	1FB3B4832E92B1E2F998CD2FF4A872000822CBB897D869194195E5C4F8D43CD0
SHA-512:	D0523CCC27436A80C5A14094AD244349EFE68FB5A813F97539C3025FCC1F05D6CEC9B8FFD04883E35BCD787A36901246687162B4B86717E81E747B2CF035DD2D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB.........IDATX..VMh.A....i..$-j...C..M...`.T..A..,6.VYj.T..(....=.^...E.....b...4i$.I.....n....<5......y.fv....ZM.z7..Z..QB...t.V..cj"...gK...e........YI.>?$.V.^......ZF...av..cn....Vi.]P.(..).v..Y.P..s....D./n&YpJ..iG....8.Z:..._.......................~3.......Y\.T...H.J......n....c.p...x.n:....i>....i......i.GvLd....SRx5?.....3G...3...i....th.5...._..CGy.....R..q.I.>....\.e>x...#......v...L6OV....uR&.....o.#...y6...c...r,..#...B(..e:.K.6..:.r....+./....g..@..!....N.....=.H....#.....j.K..F.&6Zk..."......d....].Vl...IG.......:...]w$p.+...4.......k.j...$.ja}..x...(%.x.9\|..a.d._0sy..>oL.....%<.0.C.....;..(.!tpb"...N.R.Nj..?.."...RH.......8.Gb.P.i..y.L..OMv.Q.o;....[.sQ$A.8}3..cn.!wn.N}..m..#x.'......jV...T.G.?[..3.)......X........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Assets\NewMeeting_Small_120.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	574
Entropy (8bit):	7.347738166641519
Encrypted:	false
SSDEEP:	12:6v/7iHKcqzpeXnDvyEqCcmpZndaYcfyYCta8eq0NRFWBOfmcN274Gl2E7:6cqFeXDvyEqEpZdaYcStx0LFgOfzkUD+
MD5:	503E86E4628933D17B5B41B4918D6C9F
SHA1:	F884F45CF4EF5B435E554EA30F654F076E50BDF5
SHA-256:	1C80CC98643E1D060B9443C98E9AFE663125398F7BB99E5BAB2C0EB952C9C111
SHA-512:	22D115A09597F7A8CB0C5BCD0E0BBA55798D3A431B28EC27E9DDAA356BF0AF674BDB78E6D9A3911E2750354D42A8AD628EBD0A7716410360F6D1160258E12C98
Malicious:	false
Preview:	.PNG........IHDR.....................sRGB.........IDAT8.c`.....:.....o........'XX........K.&.2.....`>........}....Y ...Li...n.......K....103.1pq..u.].. ...g........`..C.^.......w...~20...k..4.....d>....0.Bv...~.....>P...A.dddx.. 6L-8R......lY.....>!{..k]8.._@.V.W..@1.&.2.f.L...S..f..L.`...'...Oa.@....f../#.....d........G...F!..c.U..-%..q!#.5d].V.G.2.........$....k....Y.....=V.8......8S....#J....e I.YOQ..)0.(.L`..`db.q............4\|.(.s.H...,....Y+a&..r...D:aecm...&..q....Q{..[#.+.a.a4..]b.B.`\|d.g...c..j-..L..@\|../@'...........".D36.@J.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Assets\NewMeeting_Small_144.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	627
Entropy (8bit):	7.55832772949955
Encrypted:	false
SSDEEP:	12:6v/76fR8ZKPil+HE3xZKPwUonTJibKpwwCzc8oRNn/Dna+z:7R/PUsE3xZ/zsbKpcI3Dna+z
MD5:	75713D844925AC3404D59C5D56DD996A
SHA1:	88F0F5B5450772A85FD61FB5FD54C3A6F7E48585
SHA-256:	D4746496079E9C334715958852FA8FB59E54DBDEAD19D83001FA15C1793D27B2
SHA-512:	B60E132BD5251084B2C7A22591D72DFDFEBB7A24987ADB8E78CA345694F6043C1F3C7A9205B6052CF3846FCF33179506BFF88C1D1BC8093A7563CF150EC5D30A
Malicious:	false
Preview:	.PNG........IHDR..............w=.....sRGB........-IDATH..TAKTQ.>.7.o&.Y.e...ZhJ..\..-.6AK.@...b.+.h+.. .].m.pg.m.. "....7.x...;...6E.....\|.\|........&.@..../.....A.[..}...p.Y..Y....j(i_c<)...X \.nq)......OO#.........I,......-.....].4..d.!.....,..Q...vu.-PP.........\|.Q^t..@.^..dQe....^/y..'....mA....o.h.....t...x.........A..?q...>....<..#g...S .\..kko.\....l.).L.L.7.l..!KwbP.?" ...?,.w.q-....y.".\|.O....Y.4..^J....sC..Z.;~..R....8)H..p.....L!.......[^k.+.u..w.4(.1.Z..q..G.AM..{.gj..L.b.\...\.m~..N.<.f..........Y...K0J..E..^.....D)?..c,.../].p2..1.2.D_u.s.x}...?TL.?~..;P..(.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Assets\NewMeeting_Small_192.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	875
Entropy (8bit):	7.664401472706693
Encrypted:	false
SSDEEP:	24:MnF5WncYHQTt0feBgmzpRjRqgnoEmDDxM4xr8LTdIDg5X:MFAncIQhee+mdlRlTmW9uDg5X
MD5:	F323D73771349B6374462B8A4B708D83
SHA1:	39F8860AEC7AC9FF8DF80C770A23F3AC8C3BE4A1
SHA-256:	EA0327CD2D987CF069747F70A317E552C0304170177101AA578F04D2EBE9FFB6
SHA-512:	5377FD3886FCDEF87B61F1CC825655E6B977E370563B2C2F7B3BB675B8ADCCE621A47F056945A9C0A41F9C10BF4DF6694167E62A310B146587F898D39E753EB2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB........%IDATX..VKh.A..I6O.H..$....../Q."....z...x. ..."X..`OR,.C..Y.h=."^....Q.U...ib.;..ufg..d7.P.......?.L...p....Lt...-.P/...^I..X4.X..........A./&..'%'.k.....,..\......l.j'Y1f...L.....~p.?n^..N+6xF..^}...3...`..(MN..Q.H.0^`XCG.^[z......X..0r..\E.n(..@..b..#....._....\..=.,...#.7.....t.x......I.$..-..W1F..o..Q....x...P)......S!......v...zd......+...#...O.....Q.........!..2...$....p.X....g.5....e.o"..V..yQ..I.a<9?..\|.t...Z..O..Bv............Z.........r...W#...-.`.(.0.Alkp...7a-..../....Mt`.g.......4.].5.z.X.Z...gz....R.S......-.1.w`a.......<........"..E.4\|.X..T...no.M0./..F..k.P.uW.].f$9.pY&......Un..N.3\|.......`.....2..e....C......r...g.Oj...t..`..s...PE.].v.,..S.J...P@u..q........[G..0..0...9..Z2].u...\|......Ru.......}...6...W&z.4.S..0\..K....n.@a.Z....(..9.........3._.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Assets\NewMeeting_Small_96.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	483
Entropy (8bit):	7.310129121242215
Encrypted:	false
SSDEEP:	12:6v/78zmIphkxF+oabzkBMDRbuyP+3uvNg9e8lJD+SF330YN:46m0hRl+3q+nD+SiK
MD5:	A2761DE768472D09D1E02C92EBD144B5
SHA1:	60BA18F0FF47B9E9C3E23B5AE9E95E3D319B5C5D
SHA-256:	AC7FE3232888BF96C520D586C723149CD3127E1CE7CC65BC35BA1984CC27BBCA
SHA-512:	F330DB55B79E561D2DAC1CD051421F91D6981A489A004EB0EAE3AE090B1386DDF46EFB675A9B6F75A0BB83F741B5DA12E4DFB872EE41782773BFAEC9014CA667
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........IDAT8.c`..0..?i.......e....?#.Nq>..<...Y..`.W...00.......?..........;.jX.=6,4....N.\|~....._...K1.....A...l....>.{..m....2........;?...<.......\a./.tA.H.?... .l..f.......s....p...V.KB.x.D.)2D.)....l.}........`.....u.!...7,7....H.O.^.B....?..`.D..2...C..e$..:...7...B.`d`..R..D`0?.....~G1.?....KFF...L.. I.(.+6..z...).....d......5.h..q.+.2..,( ,W%-c.....Y\R."........Y..... ...7.@..?..-....JkZj.w.....e.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3097696
Entropy (8bit):	6.376562383850651
Encrypted:	false
SSDEEP:	49152:RSYwMLWjLsGKN44mG3uTMnnl5S6niJO+L2U1W1N1TfEoqeoR:QwxNN45G+TMnlXNq/
MD5:	65EE46B3B363F0673FD6381DE42E69D8
SHA1:	515FC59976C50C95E99ACB0C046BDA605BE4C130
SHA-256:	049A56425A4685160A94DE4560AA514F3F575D62D99CB0B10BE2C23F10E9D377
SHA-512:	C7A115E277C9823E64F665FD255C7257B387AD29A51D51A3BD75F76D77DE32230928A157A5FBA211B0D8ECF8F66E317FD5F84FC18F43C6116CC5925366B6F539
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........$.\|.E./.E./.E./..I/.E./.-...E./.-...E./.-...E./.-...E./.=Y/.E./.=I/.E./.E./4D./8,...E./8,...E./8,...E./8,%/.E./.EM/.E./8,...E./Rich.E./................PE..d....6=\.........." .....L..................................................../......./...`.........................................`I,..P....,......P/.......-.h.......`N...`/.p.....$.8....................!).(...`.$..............p.......G,.`.....$.H............text....H.......J.................. ..`.nep.........`.......N.............. ..`.rdata..8m...p...n...P..............@..@.data.........,..\....,.............@....pdata..h.....-.......-.............@..@.rsrc........P/.....................@..@.reloc..p....`/.. ..................@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.JsonWebTokens.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78408
Entropy (8bit):	6.129481246167649
Encrypted:	false
SSDEEP:	1536:nm6516C0z6v8JyJNPk2DuttJ6gDEkeLGzewZGLzw00f:nmqEC0zhyJNPktDXiGyRv0f
MD5:	EEA13258A8B7DE541A74D2912769F2A7
SHA1:	542082376A88F30ACAE47D71737A043A05334B1A
SHA-256:	E4FA6AC046B919137158954B182A647129990B70399C9894CE6918F0FA893262
SHA-512:	A8E7A6F7476867199D2E499ED09F11742593B398FAC4B4F3CA9C2D3496AB2A1B80A5E439F4444342D0A30BB3C74FB1A616E508DD05BBAAF6E54681F5F56BF8A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{............" ..0.................. ........... .......................@......D.....`.................................Q...O.......................HN... ......T...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........[...............................................................0..v........s....}.....s....}.....(.....(....,.r...ps....z...@...%.....o.......i.....i.3....(,...r#..p......%...(....s....(....z...0...........s....}.....s....}.....(.....(....,.rd..p(....z.(....,.rr..p(....z...(....(.....!.r...p......%...(.....s....(....z...(....(.....!.r...p......%...(.....s....(....z.......C..Q.!......s....!....j.(....r...po...+%-.&~....j.(....r...po...+%-.&~.......0..F........(..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.Logging.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41032
Entropy (8bit):	6.710594759580758
Encrypted:	false
SSDEEP:	768:vS0Nb06pBrs9OoJu8Gw1OQaXV9zPgEllVXC4dC9zVj6N:vnb0NO217GnzPZ/C4dezF6N
MD5:	E6F3F341BAEB31F4196C3085FB34F767
SHA1:	D78EBC71D36B06E0DA7FA41E6D7888FCC71042B6
SHA-256:	4BE875B73CD50A95A1480FD3330222C278903DCFA9EE73263198D860827EA9AF
SHA-512:	A38A81B096D215E04947BDD2E7D1532E676C8E84DD9CD598D98EE5EBF5C1197CF1AC690F28DA0EAB3DC1CA42CE0CD9F1EAA0901E7CD55C1ECA927D86E880C365
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[c............" ..0..H...........g... ........... ....................................`..................................g..O....... ............R..HN...........f..T............................................ ............... ..H............text....G... ...H.................. ..`.rsrc... ............J..............@..@.reloc...............P..............@..B.................g......H........,..x9...................f.......................................0..I.............r...p...........r...p.....r...p.....r...p.....r7..p.....s.........:.(......(.....~.....~............~.....~...........~.(....,...(...+(.........(......(....,..,....(8...(......(......(....,..(.....2...(...+(.........(......(....,!.(.....2..,....(8...(......(......(....,..(.....2...(...+(.........(......(....,!.(.....2..,....(8...(......(....*..(....,..(.....2...(...+(....

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.IdentityModel.Tokens.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	937544
Entropy (8bit):	5.838809981110096
Encrypted:	false
SSDEEP:	12288:uMt+vIZDreuKQvgXyexT4Yn2sxGwmBgjoIb:jVbgXyeV46xGjBgj1
MD5:	528D783F83C540EFC5F138D21E8C1696
SHA1:	64F87F45719CA06143AA6328A52E6A96285DA63A
SHA-256:	CE06CDE2B771E6E215CA9A10F8739A23AB2990A53C32301E42838D40E8E355F3
SHA-512:	ED2562BE767103C2FD7179B0F632A2250F8EF97950341C6D0FE6AC8BA347499682CF7201289169855F313D47833F863FCC110B54864A8BBABF046FFD8B5902CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........." ..0.................. ... ....... .......................`............`.....................................O.... ..................HN...@..........T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........0..X...................T........................................(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{.....3...{.......(....,...{......{........-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..o....aX...X...o....2.....cY.....cY....cY..{......{...._..+%.{.....3..{.....o....,..{.....{......-....(.....0..H.........{...._....{......s

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	248904
Entropy (8bit):	6.150746670116204
Encrypted:	false
SSDEEP:	3072:Le3vee9g5nwddPS764sTCYfMLG/Hb25jiV9MPsJvgk+TB:E9GGd676469Ma/RVKPsJYkA
MD5:	96E9C38D030B3ECB4E674227F2214272
SHA1:	8D6BFF68B89630C7DBCE8A5120110816BCD2B881
SHA-256:	170B6F45031B97C665AAF19B4A85E1DCE035243A0972CADFFD855B11E15C9F2F
SHA-512:	773C8E286ECC0AC57F14C6F46FB58327DE21F04FBC7B3977270D0A7770E0CEB9E0D4B60A79D1DA82E7D1F4FDD40AF9281CFBE78B27C180BD7B57C2F29E99B7C0
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........S.^.=.^.=.^.=.W...V.=...9.Y.=...<.X.=...8.}.=...>.Z.=...>.\.=...9.[.=...<.P.=.@...].=.^.<...=...9._.=...8.V.=...=._.=...._.=.^._.=...?._.=.Rich^.=.........PE..d.....Xf.........." ................P...............................................>n....`A....................................................@....@..pj... .......~..HN..............T.......................(...p...8............................................text............................... ..`.rdata..b...........................@..@.data...............................@....pdata....... ......................@..@.rsrc...pj...@...l..................@..@.reloc...............r..............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.AuthLib.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40008
Entropy (8bit):	6.683761370543717
Encrypted:	false
SSDEEP:	768:3nom7dmnAf1LHF51ap+v/7pK+4nCLEpw9zUzgEl3H7Re9zno:39Rhaps7pnq2Ep4zAZXFazno
MD5:	8B49A5EDDC4FD8D66224C96F90637305
SHA1:	683B198B685AF5329EC6EC1171266AC84D3B7ABB
SHA-256:	04C9F32B9FAD48DF69E9675B30554712AC87659ED9B4AE29FC04007DFFF0092E
SHA-512:	C55A44341A8B748C5F7092C397D494B2A98922AB2C2B7CBC994640F6663647640FBA4E7BF33C5B4E01F4951BAC9BE68A764309D3C83BF49F247AB563A59776AB
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...f.Xf.........." ..0..H............... ........... ....................................`...@......@............... ...............................................N..HN...........e............................................................... ..H............text...<F... ...H.................. ..`.rsrc................J..............@..@........................................H........-..t7............................................................{...."..}......{...."..}....V.(......(......(....~.(.....s....}.....~......}.....0..+..........{....~....(....,....{....(.......(..............##.......~......0..........~.....r...po....~......!...%.r...p.%...%.r-..p.%...%.rE..p.%...(....r...po.......{....~....(....9.....{..........(.......{....~....(....,r(....o....(....rc..p(....(....&.....(......~....(....,+....}.......(....&..@.(....&. .....(....&..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.Diagnostics.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	32840
Entropy (8bit):	6.85712169528054
Encrypted:	false
SSDEEP:	384:z5BNiiCAlw5LfyacHbZTowwWYsQWSW/7R9zkV+Hh5yEFHRN7GNQSR9z+zCu:zrFo5xwlvfF9z6EhgElG6e9z0Cu
MD5:	D24A006BCE2DB1A2F0463714BDA1758F
SHA1:	1DBDAF547C164430F8A1E59F4DF6D95E7A31F001
SHA-256:	5A2FE2BC4E619066404BAE87FD7D9A449054977D64F7D3825A8A63254070A07D
SHA-512:	9AFCA008708C0E389DD7443C8A10F651D1216D4B7134122B96645F73645CD7317C6266B7D30F586C253D87083973AFB006C0418A981FE7478A2ADB0CE373C3F2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d...e.Xf.........." ..0................. ........... ..............................j.....`...@......@............... ...............................`...............2..HN...........H............................................................... ..H............text...H)... ..................... ..`.rsrc........`.......,..............@..@........................................H........(..P..............................................................-.~........-.~.........0...........-.r...ps....zr...p......%..o0......r=..p(.....%..o1....$....%..o..........%..o2....%..o4....%..o6....(......o8...,..(.....o8...o....(........(......(....../.rs..ps....z.(....,.ry..ps....z..}......}........0..Y........{....-7.{.....r...p.{.....$...(....s.......%.o......s ...}.......{....o!.....,..s......F.{....%-.&("...r.(.....-.r...ps....z..}.....0..0.......~......{

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1096776
Entropy (8bit):	5.795453024854296
Encrypted:	false
SSDEEP:	24576:nH7Ek5BVh5Bsu0G179oVVmfLEq2aw+QUZT:H7Eds79oVVmfLEqNw+1F
MD5:	AD514AF0C57668FCEE3C7AAD08B398E8
SHA1:	8A1E7B31BF4C7784CDAF8497A73CEB5210A8FEF1
SHA-256:	37879DF89E78E89ADB33918C3CA4D0DF623CEB059057FA6A7FA828100D98F19F
SHA-512:	CC1905C4F7F48B727DA8FC240F641EB881D5C328496EB9ADA257EB09424FB761354C32F08760C60AB192F43575A28917B2C1262AC7E716C2B1A1A13E97297F22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..0..f............... ........... ...............................T....`...@......@............... ...............................................n..HN........................................................................... ..H............text....e... ...f.................. ..`.rsrc................h..............@..@........................................H...........H............................................................0..%.......~.....r...po2...~3....~3....~3.....sM...}.....{....9.....{....oZ...,.~....r3..pr...po4.....}....+h..{....sd...}....~....r...pr...po4....(5......{....(...+...{....(...+.~....r...pr...po4.....o......o.....X.~......r...po7....D.~3...(8...,..(9...&.~3...(8...,..(9...&.~3...(8...,..(9...&.(:...&.........."..........."....D......(;....(...+.....*.0..C........o......o......,..oa...(=...,....o....+......o..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Teams.MeetingAddin.dll.config

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	5.076136391837345
Encrypted:	false
SSDEEP:	12:TMHdGzNFF7ap+5v5OXrL/2/tFicYoKV7VirkTyxm:2duPF7NhOXrT2/H9kirkV
MD5:	ED080ED5825CF4893CA4F7D1395B9957
SHA1:	3905E190109E5DF90676F4716A69C815A6E52B44
SHA-256:	29F368DEF465F1AE30DF31EBCA4A976F180DBCF3718605B4ACB0D6DA95A30855
SHA-512:	73041863B7916B21A56D5C61933D9922D24B15548D7356DFEE42C3AB617F72A04AA8080F3C5EB3F21D968FFB38C7244D4484E78540BF6BB8FC93600A017E43D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/>.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0"/>.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8"/></startup></configuration>..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	295008
Entropy (8bit):	5.771512173166689
Encrypted:	false
SSDEEP:	6144:6ylhq4ugopeh5eBeGNx8cNe+zcee9eoedTeeIzeqRK0e6eR9pRFIEIEEICepM1Sj:2P4eR9pRFIEIEEICepM1S2LQQs1hP19x
MD5:	D3A3E82247F81342E217C92B9C89BC86
SHA1:	CBD914785348331AE68528ED71E317ECADDC10DE
SHA-256:	B39CA19017B8B99385A588433B4AA1CC87DDE272DA14771A9750F00605D31091
SHA-512:	EE5968A216BD402632A0CA1073B8C4CA5303CF28F30002AAAF2E7590B565FA3BF951E7B62320E4E3592DE50B9F56F08ECADCF67B50659DF056BB5812388A962D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....].a.........." ..0.............H... ...`....... ...............................b....@..................................G..O....`...............2..`N...........F............................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................G......H.......L9.......................F.......................................0..G.........((...}.......}.......}.......}.......}......\|......(...+..\|....(.....0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......rZ..p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....*.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45152
Entropy (8bit):	6.663371468091526
Encrypted:	false
SSDEEP:	768:iTFfTl1XWYTACPHZDgcE05P4Jjrnh2jwSosuTv1JKa5/Zi/6LsubsOzMnXbD9zMz:iTFbHXLPHZDgcE05P4JjrnawSosu71Jh
MD5:	F86AFF1B72BF70884B4BE0CA38919369
SHA1:	8D3DDF77DE94F5EAE244AD09F9D2ADDCC2DEF709
SHA-256:	69B2BBF16659F98D589942A1A3F344550DD1E03446DF4F81DC4668F1D51CFEC0
SHA-512:	718F629F907EDFADFFCBCA135DB6153B2BE001E450940722B43C16279CF9ED0A6384D1205D3287F397B2E8FCD9A5615BB2497E8717B6CF6391EFADF1BB122480
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...03............" ..0..X...........v... ........... ...............................B....`..................................u..O....................b..`N...........t..8............................................ ............... ..H............text...$V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............`..............@..B.................v......H........3..T=..........(q..@...ht........................................(......{....>..}......}......{....>..}......}......{....>..}......}......{....-%..(.....(......(......s....(....}.....{......#.......?}.....(....}.....(.....(S......(..... . ...(......,..(....,..(....,...(.....{....,..{....o......( ...*.0..>.........( .....}............s!...("...........s!...(#....{....,..{...........s!...o$....{....:.....(#......H...s%...o&....(#......G...s'...o(....(#......J

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50760
Entropy (8bit):	6.631383698123452
Encrypted:	false
SSDEEP:	1536:0X0t7C3ZK8wDP/ryEH0mBO4JjrDXaUfUPLkIFKKa5/Bi/hGvoAwWKSVdxxzXZVP/:0X0t23ZK8wDP/b0mBO4JjrDXaUfUPLkR
MD5:	04B900A20C71F7A23BEBA77F88B86308
SHA1:	C5BCD7AE974EBF89F6D12F26DBAA9B4FD4CF2A53
SHA-256:	BBA041B5BE0946EAEDE57AE31361844CA781C9FAE80607980465C7F2422F83BD
SHA-512:	F40B2ABAD653F4433D8B7C665D37000780D7A1289F4B187F8B51CA7C8D577C7D7449A5E12C0DCB1FBBFC45403437D6F9F4AD09CA326239C4D1823908063CE19F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............" ..0..p............... ........... ..............................8.....`.................................9...O....................x..HN..........d...8............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............v..............@..B................m.......H........;...M..............@............................................(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....6.t.....}......{....-%..(.....(......(......s....(....}.....{......0..........r...p.P...(.........(............s....s....(.........r1..p.P...(.........(............s....s....(.........rO..p.P...(.........(............s....s....(..........(.........{...."..}....&(.........{...."..}....*..0......

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	714312
Entropy (8bit):	5.981067761075983
Encrypted:	false
SSDEEP:	12288:H9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc30:H8m657w6ZBLmkitKqBCjC0PDgM5
MD5:	D473F50D1D29B975DA5B6EE0BE8DAA16
SHA1:	AAFC94D3C26041CCA3737FDF6240290DBAC1388C
SHA-256:	E57E1BD98CF3EB35B61BC5603DA893DD8018BE8CD6CC582D263CD964CE1E47DD
SHA-512:	1BB89EBE3EE9D61ECD194ED008C25733C5888FDBDE41A3D248161EE4A708526489A2F79D23EEE97CCAB0D58622ADDE158E07225B8A64AD1F6593CF848206FACC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ...............................Q....`.....................................O.......................HN.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{].....{_.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\OneAuth.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4255816
Entropy (8bit):	6.621144248265792
Encrypted:	false
SSDEEP:	49152:6vVaimCiynv9z1Rgzg5mHIZcAf8liK4B7sCIIcxiVztD4Up1ljWp3HGmhMhS+/Nt:64uz3gcmpXGmiMDTw5
MD5:	8E3C04EB2236C4CB93A631AEDC3EA9C8
SHA1:	B4E83AEDC2ED818705A0F2EA1C544943D0D830A5
SHA-256:	E9E25A64D404F38BF8DC6CFA94A80B7CC8C758A5E32CD671C57BA6F32D05BF63
SHA-512:	35F264538670B290DB473CA32E6400FCB3A3D4053180E61F4D49B8CE2D66C8C3C9AD30A60EFCB8D3A2CF1B6B7F75C34B648A52CD85B837E8F954A444543682E5
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$..........O..................R...................<..........................................................P......8...........Rich...................PE..d...y.Xf.........." .....z..H......0.&.......................................A......A...`A..........................................;.$.....;.......@.......=..r....@.HN....@.Pj....6.p.....................6.(.....6.8..................`.;......................text...\y......z................. ..`.rdata..............~*.............@..@.data........0<..`....<.............@....pdata...r....=..t...x=.............@..@.didat.......@@.......?.............@....msvcjmc!>...P@..@....?.............@....rsrc.........@......0@.............@..@.reloc..Pj....@..l...6@.............@..B........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\System.IdentityModel.Tokens.Jwt.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	94312
Entropy (8bit):	5.905204811037498
Encrypted:	false
SSDEEP:	1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gj:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0s
MD5:	A70D021C422B844D5B3708A619466057
SHA1:	5F63C78F20FA7E7ACA36C91F209D4215C854C90A
SHA-256:	5692B8A4E74EC8484A87D68379FC69FC119E980F79D2765F7FCA5BF5FA302024
SHA-512:	A8CDCC3043376A1D25B318739DB7545CCB0ED77C1E134CC03B5A009A655EA6861EE3E7246EBDFFA6D53B6BE31EBFFF93B34322488C1067712F0A280ED2B8ECB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............" ..0.............*7... ...@....... ...............................-....`..................................6..O....@..............."..hN...`.......5..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......4_..0...................d5.......................................0..........s....%r...pr...po....%r...pr...po....%r ..pr,..po....%r...pr...po....%rG..prU..po....%r...pr...po....%re..prs..po....%r...prs..po....%r...pr...po....%r...pr...po....%r ..pr(..po....%r...pr...po....%r...pr...po....%r...pr...po....%r...pr...po....%rr..pr...po....%r...pr...po....%rN..prd..po....%r...pr...po....%r...pr...po....%r...pr...po....%r~..pr...po....%r...pr1..po....%r...pr...po....%rm..pr

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\System.Net.Http.Formatting.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189544
Entropy (8bit):	6.2575053993527705
Encrypted:	false
SSDEEP:	3072:MXWun8Jw8fCk/Dvf5eso7DpGbG8pwp2xuRLYs8jn4xo:MXWu8Jw4L/D3UVVGbGbd2
MD5:	8FBA542C86765B116FD3B6A397196984
SHA1:	47D65C9D0C0D07C4E76F3516C90E7FD1CEAC1B0B
SHA-256:	7E0C5104F49C2B79E0261BAB191CF7ED25BBE9C01BCB7DCEDAE5C6AA1F8BA94B
SHA-512:	89C05EFE882C226EB55A0D234BE49E2D4D639DB08FB0BF85129E672CE3773EFFA82E7F95EDB1F7DE1F3B8B57B38203AA69E8B84CB51885A9CE9918332DC06D22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..[.........." ..0.................. ........... ...............................L....`.................................D...O.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................x.......H.......D...@............v...3..........................................R....s... ....(....F....s.....(....>.... ....(....*..0..d........(+....-.r...p(c...z.o,...-(r...p(...... ...%......(-...o.....(^...z.-.r...p(c...z.-.r...p(c...z.../.r1..p.............(g...z.o/...rG..p.o0...-'r...p(...... ...%..o/....%.rG..p.(^...z..o1...o2....>....rS..ps3......}.....o1...o4....+E.o5......s........s6.......o7....o8.....o7....o....o9......o:.....&...o$...-....,..o#.....(...+:.....o<...s

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\adal2-meetingaddin.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1769056
Entropy (8bit):	6.166747246802417
Encrypted:	false
SSDEEP:	24576:s5EOB1S6bxNZHY6vApo47bw0puGr7WH3TvKsUfWdZAujbC/:s5Ei1S6bvZYn20uGr7UTtdQ
MD5:	68489533091EA68287F7F777301585B3
SHA1:	4DF72C6058EAEC0595B3737703F75E452EB49704
SHA-256:	61B5650FAA6325CD16E3A65739017421043D618B122780C5905AA24A10122ACE
SHA-512:	D2297C8A14C44CFCD1E7F06C52E111A25DDAE050A76E72E14F6ED0FBB15D35DEB0ED4AC134D342FE9FA49CF4717177C1763BEE82A1FFA3AF3B7B06C62A4B3624
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......`..$...$...$...K../...K.....v......v......v.....K..3...K..%...K..9...$...H...M......M.....M..%...M.}.%...$...&...M..%...Rich$...........................PE..d....l.[.........." .................]..............................................i.....`A.........................................-..T...47..,.......8...............`N......0%..`...T.......................(....V............... ..x....,..`....................text............................... ..`.rdata..L:... ...<..................@..@.data........`.......P..............@....pdata..............................@..@.didat..0...........................@....rsrc...8...........................@..@.reloc..0%.......&..................@..B................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62536
Entropy (8bit):	6.619052550214228
Encrypted:	false
SSDEEP:	1536:KO9gSK8rih93rkkMy6HMyFPcIk9WvLdQWuB5X2PHJMK1SNahIg8DTuf3T11EikM/:T9gSK8rih93rkkMy6HMyFPcIk9WvLdQM
MD5:	918B2973A82BDA52C4AC8A09D2574E1C
SHA1:	40FF2FBFC9D48610CA8334696D0A8292E7F98B2A
SHA-256:	F43F46284EA5B51849A485A76D6435B37D830EDACE7C3FBD461703A24AD50CE4
SHA-512:	41098F24BD33E89F72D4A5F4A2F07D9330C57CD36EADC7DEDB1F793C7C893C231320033BF87E28197EAD74667636444530180C57C78A4E9EE68575B86D285E3E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..o...................................................k..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65640
Entropy (8bit):	6.573404012365602
Encrypted:	false
SSDEEP:	1536:6O9nxMvE5lU94Zs+uNQGChcfaEt5tHBB8spapY1KCcLJIaSgN8AzlaGEikcwsLzv:D9nxMs5lU94Zs+uNQGChcfaEt5tHBB8/
MD5:	EB05AC049255AEC7D000FF9164B5C579
SHA1:	8CDB9A4576EA58DD1C10F6E3426A01CDFF5E7E6A
SHA-256:	ACF1548E834F32D5AC15B7B2393CA55C098F160222052B0EBF9BBB6B86E13DF0
SHA-512:	20DEB44D7785D22B5B5787B5640D063DB48E4CB68C3B719C04B9E1BCA21AAAF46F471E6A580DB7C521A98BF2000D2FB02F89E14E81DBC3F18F4FF0600B527BEA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................08....@...@......@............... ..................................................hN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ......................................................}..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.4892523851181485
Encrypted:	false
SSDEEP:	1536:3O9PKsQZAjb+f5g3GTGw9dLFqH78Iu3vwUT/aDXeX3iqeVQkiO7imZOEikxgsmzG:e9PKsQZAjb+f5g3GTGw9dLFqH78Iu3vU
MD5:	0042BCE2705220E9992DADEB9725B4B6
SHA1:	AA3403D14D626E96BFA25807D437AFB70874B7BA
SHA-256:	48BA5EB4C48A09339870E676668D46F1A91A12C7DD362C571B0DF8898245665E
SHA-512:	61083CE34048F15D7737670F27551822C4ABC84A0021CEFE2942A35C5BBD88A27DD85A6678ED6377F8F041A3002AABA8D7C40623C2733365AAF7A17CF5C5633F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................:.....@...@......@............... ..................................................HN........................................................................... ..H............text...`.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..6...................................................2..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.561446350526192
Encrypted:	false
SSDEEP:	1536:/O9CKHHlgdQ4L2QSW6YEcNHuSlMGtrVSL4rOeqDuseAT8HNQ3spEik2wsezBlZAv:G9CKHHlgdQ4L2QSW6YEcNHuSlMGtrVSq
MD5:	8CD85487C33E93419C0B4DEF6256DE5F
SHA1:	C1B6735FB85B9CD557E16286ADC0842302394445
SHA-256:	CCCEDB9A5C9E8962EAA1AE49336911FE9B38402A77EB6F402C2E4CBD93C71887
SHA-512:	C221DECA3F0C69C6D25F8709AA2501090CF5FE113D1764BA39D7EBD8EC9C1C1B281A8D20F586AD6F52BE17BDAFD58AF85BFF034592FE2A3F6EC4BB7F600F6B0A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................S.....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..k...................................................g..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.521529157814906
Encrypted:	false
SSDEEP:	1536:kO9ADi+BGe+Yj+fEligSKm9qI32i3loAECsedjllekCRf4FwpL6pTgskpEikhQsS:R9ADi+BGe+Yj+fEligSKm9qI32i3loAa
MD5:	E30390D70C3D4089E674A6A1E953AE77
SHA1:	5AAA7EC14E8BF4FAB1BDE339C67E97D0D5BAEF4A
SHA-256:	D48E430A4641A2659F425E07EE20F1B7047A958AB3500204315E681F98712199
SHA-512:	9E1755C9B874CAB0B7375700289535BF39303275F4AB46DD4B2694D8C4CB8EEA93C0F4ECB267D419F9A43C69B3DA7654425867836066A16494A80A11470727B1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................K7....@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\da-DK\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59488
Entropy (8bit):	6.519135032255633
Encrypted:	false
SSDEEP:	1536:8O9Nhjxn9FWv4GByP5KpHSnLbM9B5vBmGOv0/kOeR/1OgBly2bCx4EikxgsCC4dj:p9NhjV9FWv4GByP5KpHSnLbM9B5vBmGE
MD5:	69361950F536EFCB3345972BD44A788B
SHA1:	11AAD570C143AB9C2A3FFB9D8F12D6C7376B8291
SHA-256:	4778D0F95106388141E524649B5E9D365626A1F00A522D6F0187B4413E633021
SHA-512:	024965A5B9FA7451188C4EF63E95840AAE9122935DF35538653C2E66DCEBA40C8DC77686761AD53FFE25AFC1479ECCF5105A551E11BA2D80A9C88CC5EE929235
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ...................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\de-DE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.501050121893406
Encrypted:	false
SSDEEP:	1536:6O9P3k0b/0/IDJaXmsl/+ToOLWiXp3n4bydq5inL+yPocyx+q92nYHYHzB2iHG36:D9P3k0b/0/IDJaXmsl/+ToOLWiXp3n4k
MD5:	82C5114A1BFAF242A09136EC943B30F3
SHA1:	0CD51F2771F1B6F12F770C510B1A491177334CD2
SHA-256:	665981F1234BFAD8C0108D1C7ECF5097C2EC918D9F164A4B7F8269A43C55917A
SHA-512:	FC8638592A7FE0114B8948ED4FB3EE9EDDC20AEFA16C8741D8A706E7A2CC8186E50EBD7E530D1320AD9A80A2A9757CA36140BF3EE4DDD03D0D33A87078783820
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\el-GR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66632
Entropy (8bit):	6.59091502517811
Encrypted:	false
SSDEEP:	1536:+O9OCfiY82Whhf/Oaxtz9dgqn1LsIOYCZx/QxJHDv+sBkzKJMPYBj8UHNDoEikcj:X9OCff82Whhf/Oaxtz9dgqn1LsIOYCZV
MD5:	7FE494D6AF0B9325257186DB2F2A5B3C
SHA1:	B1BDD6D3156FB5BE8CC7C0FEC22F85DF8F5F3887
SHA-256:	DE2284A8BCBFE4B747AE0A53BFB8055791BB2AC63661581C76278674199A05DA
SHA-512:	0149FC3ADBCAEE5C710EF05E3B56D5C39577213708485BA045FA3F8223757B7078327B080932593839548DF46481CC506898A4DF63A9F92E3CF650237EAED992
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\en-GB\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58976
Entropy (8bit):	6.513267731001312
Encrypted:	false
SSDEEP:	1536:ZO9jlXq39V7UTJazmvWyBmehkkSgwgt7pK1Iq6lDRyFxutpLdcIkey5ZvEikNQsP:k9jlXq39V7UTJazmvWyBmehkkSgwgt7j
MD5:	A35042A4DBD03ECE06C1E77A060ABC61
SHA1:	F854516FA8503BBC42AE13D484548B82D298642B
SHA-256:	373857D0601291C5A931F24E44C55DA79E8ECD6D20FC1F747001F3CC07373D60
SHA-512:	3996ADA54AEEA1C1C83535E5D7CA3269340DD7F944DE8B92E274A808350DC513683EDA368135814A9DBE1133A0238A34557DEDD98C9921AE364E9A95EF87C026
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................u.....@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\es-ES\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.497159783858232
Encrypted:	false
SSDEEP:	1536:YO9PcsKNcG6/SfNsIpERGRBPvJV50ATCaHC1B4/QYfsueQ5amCVBjEik7Qslz0ZW:l9PcsKNn6/SfNsIpERGRBPvJV50ATCal
MD5:	2204315EF94FB761A9881358A5E76A24
SHA1:	23AA21968A31225F55DDDD05786AE3229C034721
SHA-256:	790BDA84F8558D880F31BE0D2623BF91B042FB887DE7BC34838B2A7B2F809E84
SHA-512:	6C85AE675793BC5692310076C70BFA6E58FC58485FFC3E61815CEA124732B5C70C63C9385E6906F8296274FF021EA4C97E4ECF74CFEA6417438C74747A2864DF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................#....@...@......@............... ..................................................HN........................................................................... ..H............text...\|.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..S...................................................O..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\es-MX\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.496671021509118
Encrypted:	false
SSDEEP:	1536:IO9PcsAbAUxcRLSpEebIfb5lG2vuq9o7UtIbQrZuGl2v/+/UAsO8jEikKAsNzrZL:V9PcsAbAUxcRLSpEebIfb5lG2vuq9sU0
MD5:	D55D270FDAA1438E86CB88A50D14307F
SHA1:	A263D5CC55A46E6425BCE9755EAB5C71CB130015
SHA-256:	E043A91947011D2A147E65CDB2740632D823E16D41972C0FEFA5E8292CE2404B
SHA-512:	EC83C29D02D75167562E7B7258FB522DD6A6F37C813F71E265F9D59610F5BC3886965647806F7E58D75F48F3646101657B5CEAD58093DB51A58802C727706F2B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................q....@...@......@............... ..................................................HN........................................................................... ..H............text...8.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......`...............P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\et-EE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.518455229340612
Encrypted:	false
SSDEEP:	1536:YO9pDyWBFils6mKaFq1ZU7iPZn3VfrsYaInkpxOM8zrBwl0xvWbiLv8LEikkwsO8:l9pDyWBFils6mKaFq1ZU7iPZn3VfrsYo
MD5:	C9A8FE2E0F679F8463B88547C27255DD
SHA1:	C3AACD5338702F76A1BBE8577601850AE96FBEC4
SHA-256:	25D3804E16CAF591F113CF8F88FDCC2C7B0FE2CC86F6E443B0FB3B87E3D9B5D1
SHA-512:	2DE3028BB76C51E15ED96BC6654C0E8B14548BADB45AEB3719704B51B7532D7CCB4D87CE21C5ADEF5A1E9A50B356F9D4A64BC46EEE9DF61AC46296C1CE07300B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................i....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..Z...................................................V..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59976
Entropy (8bit):	6.5124724749609975
Encrypted:	false
SSDEEP:	1536:vO9WHroG73/MBcBgbQtAIceIZJA4qErCGAqNDEvu/XcgKErjRfxLzqkXzEikrgsg:29WHroG73/MBcBgbQtAIceIZJA4qErCU
MD5:	A101FD35F9452436479CBC0569AF5F0F
SHA1:	A8270B69B7D54BECD4814E8436AA316EC96D397B
SHA-256:	6A8A99D5DC4CB1A0F62D87F8558C6ACF375DE8D696C46920A5FD400B3841D4E0
SHA-512:	422C3989345E5E343205433E5709135573ED50AE18DBAC33F9A898E2CDDA65A2CE53DF9A774CF6CF92650057E8BB049B30DAF8216D263507FC20B18357E8959F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..V...................................................R..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.501505785175988
Encrypted:	false
SSDEEP:	1536:9O9ADK9GGZoFZbcS0PFl8SJiJS4+X2uMd0dSBb/yNvd1SiUU/GpgYCv1Ny7iwEi1:I9ADK9GGZoFZbcS0PFl8SJiJS4+X2uMD
MD5:	43EBF6698E8ED6E57A8A3FB079F718CE
SHA1:	D282791F153159EE4093CB2424DC52C2E334BB40
SHA-256:	A3A951E4BED1FD9F001A20886878980EDCCA336CC50054B1C9CDE99A2D2F2533
SHA-512:	0111ECFA04BE397A235F2F1549046831577676F90984F34B1919AD1B8B6CA5D8DCA8FCA5650DB99B85253997BA95D6971B43650BB29781EE64BA79B2434EB096
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................W.....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.507124752707679
Encrypted:	false
SSDEEP:	1536:XO9ADl++Qh8hF3dLNbJZIeiVFbdQ9cBxIjfwjRGaDZng/7HXwpJjAvvhYpvvFi/N:+9ADl++Qh8hF3dLNbJZIeiVFbdQ9cBxq
MD5:	B500AD907A9F4E95314179A34DEC75E7
SHA1:	DA22B47E32D7DE1D8BECACF2392CEF47D3460977
SHA-256:	893EF5FEBF0F7118E4E7A6EF18A521C6A85A390FBDBB03E19754E83A60841945
SHA-512:	4C88E4975E5A375FD8E958B57BC400796540CE80F9B393C77624C0652BEA26B113AF9136B43FD2B7C5BCBEB5382E73EA93743B8F58DB3BE022921B52E2204F55
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\he-IL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62024
Entropy (8bit):	6.56914871344235
Encrypted:	false
SSDEEP:	1536:lO9CElFACr31NvYOv0ffLE2WGNFzw9mgCOppcdIUX/a9BcPF4O9M6XPfEik2BQs+:w9CElFACr31NvYOv0ffLE2WGNFzw9mgX
MD5:	4BDBF1DBA1B7B321E15265EE6D7E7195
SHA1:	53708179AABE57782275FDDBD5DC03133CF3FE13
SHA-256:	A880CBAB569A1A1B79FDD0BF22AABEB970ACD52B7F8DEF9930C8FEA4F2119888
SHA-512:	D825BC8A138E5C70FE7E3FC242DE5E03C653C6CD5A97E9D26B29B1294ACD4A74FFD9CA8A3E31B33936A390DFC4E4CB630EC3FD055AADB6CF6BEF9EE958124377
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P ..q...................................................m..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.500655599661843
Encrypted:	false
SSDEEP:	1536:nO9dO2GxyJQPMKJUlRKXQu+aOdD68/8aEv8Fez74mwBxG211H/KqIG1EikRAs/zN:O9dO2GxyJQPMKJUlRKXQu+aOdD68/8a6
MD5:	A17F101F048C7E157FE53D6C533D298D
SHA1:	D3D3D09BBBF7269A269368818A039E7EA5779CD9
SHA-256:	FC5560A78421EB40350F57221995647C8136156ECC81A8A8E9C1081FD07FF038
SHA-512:	F79F07492674C88AC76EF3966C38BC5C7C1A2190A6A5778B5ACACEB8130476FBE7C48C8CC3182663ADC61FCD4BF0C3342EA7CD2147BC6D87B449280F5B93B8E9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..^...................................................Z..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61032
Entropy (8bit):	6.545333848393183
Encrypted:	false
SSDEEP:	1536:5O9PebzfDSD12NfIBLCOP8mTtzDd0Wx4Ky6Vlm3KlbcGUYTo1f8Q8ZOQXOQ8M0Qb:E9PebzfDSD12NfIBLCOP8mTtzDd0Wx4i
MD5:	E3C3CD6A7D0B5BE8FDAB1353EC88E841
SHA1:	25F66AE84F3804709441812F9148CC3638F44ED9
SHA-256:	147FC977F5955EE8ADBD02DE361444D7EA76AA52C3F376E817D0031A1798586D
SHA-512:	0740D73B3E3AE434119A852DBE23295407547CC45A015B5C41E32AE7D2F9681A8681D6BA30224D8812693B2EE6A8C33C28C0B9A6E1EF6305CCCEDE435FC07898
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................hN........................................................................... ..H............text...(.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......P...............P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\id-ID\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.487928672817359
Encrypted:	false
SSDEEP:	1536:zO9NagPURiGTqSzcnYzsdxAeetb2YHEKTtWA16o3vPjBjtLP7bUcEikkHwsMzEZv:a9NagPURiGTqSzcnYzsdxAeetb2YHEK5
MD5:	E63026CCA00C40945973E40C060537D0
SHA1:	0B734DE1E644FCA3B91817956079187F107B88CB
SHA-256:	8AF427016925C688B075C8E6621F8141B6CD47C585CD2AEB1E6029F27BE881C7
SHA-512:	73CF03C490732D18E94A0076FC3F4ED0B3E20B9FCFB46BB8AEB3FC25F7D3AE38EFE51229170567BC8735AA986A49D4FD06417EA66DE5BF48106AEB50992414BA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................Ga....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......,...............P ...................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\is-IS\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59976
Entropy (8bit):	6.531167197804544
Encrypted:	false
SSDEEP:	1536:aO9WAqYD97mcB1jaIJB8E3rTYSXxVG12uonduxkeU+BJRUJsQVr1q4EikrkwsOzf:j9WAqa97mcB1jaIJBP3rTYSXxVG12uow
MD5:	00F47F64738E11F38F72C6C82FCB84E1
SHA1:	1F55D1C6BF1378CA0E8B564E248C2483A59FA07A
SHA-256:	49CBA0B6AC65DB3176B850D610055A6F0897F121E1DD6FEAC1F419986627AE24
SHA-512:	1B586222146E4897E9B3DF351E9AAFAC4C80958629F1D255225C265B90F7DAEB4DDD9273E8944E08D19BD6278AE49A650B2042F9A7C2D62193131F1C31392883
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................t....@...@......@............... ..................................................HN........................................................................... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......l...............P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\it-IT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.471403653759095
Encrypted:	false
SSDEEP:	1536:sO9P3y5h0Fp0NK/gRcFvoZ4FKKC2msifHLrEvI2UzpCwqPZHas2dyHrWEikrQws3:Z9P3y5h0Fp0NK/gRcFvoZ4sKC2msifHf
MD5:	7024B9BB3F91080CE12B744352561DBF
SHA1:	C971444A6DF7F332FDFED322F764DB15EBD398CB
SHA-256:	4037E573F2D03C612B1A18EC231B66291722096B9CA9BF5B9EA6387EBFEDEE35
SHA-512:	45B4CFFAF77FCA07DEC8EEFFDE6B43BF1F1D54FFE16C66A7F2002E89520CE412243844AE275A01218A7C0767339467731420920C4C943574AB3A6D52919BB6A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................n....@...@......@............... ..................................................HN........................................................................... ..H............text...T.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......\|...............P ..+...................................................'..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62048
Entropy (8bit):	6.68305367310075
Encrypted:	false
SSDEEP:	1536:EO9WeuzR+bLcQmuGuRuBG6v7yM5uGJ0HIc2N37cRAoXDuII5ZCUaRvEikkgsRzzP:x9Weud+bLcQmuGuRuBG6v7yM5uGJ0HI4
MD5:	07440CAE8E6B27E2BC26386AFDDB70B6
SHA1:	76084A1A6A5B8BF6BC688B0D88228F422AC07144
SHA-256:	1EED650838D7C0BBEBDB83A1B8D9997D2012FA6E1304E2B7BA6828AF6115F3CC
SHA-512:	C759918FF36CEAA7F1F9F4FF22D1AD578E1DE997E0FEFFA005801693815E2F8D1E5200B1975BF4711D5A20067FF72E31B180A504F927E80F82F5F9BF1FFAAF86
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.6739946564864026
Encrypted:	false
SSDEEP:	1536:hO9WAqhvGiu7WCbAfU8Uvg2LKhiM3fYzsKNLz89SghOD/4Ke5XzjEikwQAsAzyZO:s9WAqhvGiu7WCbAfU8Uvg2LKhiM3fYzU
MD5:	356873E063BD208A4D216D5276990B49
SHA1:	78CBEE7DD690AB66760388D5334C4A4EABE95438
SHA-256:	D583A30A4C38711ECF4CE369D153994297705086E264C5D083A0D9BDF016F980
SHA-512:	EFBDBEB5569BBEC794D259263129246DD125CE338D2C7225D3DCDFF8BE5685F8D035C567C6E9C78740C7DB7610D1F423D55CC5B12E8F9859A6F1581119F1D392
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ............................../.....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......0...............P ....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.537260960859277
Encrypted:	false
SSDEEP:	1536:vO9B5vAqvshLrR3gUZO2A9oclmD1tdDnpRmtQH2QKDTLXosU2ex+nuYEZEikg9gd:29B5vfvshLrR3gUZO2A9oclmD1tdDnpe
MD5:	D02761F132672E5B23C669A12FECDEE8
SHA1:	4EDE1CDC961CB562E26D895304EA15DC7861F909
SHA-256:	37B47B96EF781DC85D7D16AF45E9CCBECC621BFB8829F3E7F5675DCF30787C0D
SHA-512:	0B896B49011A6292ACCBA5A2C2E6AEF9144889A9EB57E37C55AFB2DC11C861FCBCD363C05833F1F3D9E3DF70CD77CBDB5022A1D8AE1B56DD2050C2EF46027251
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................@f....@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.550250140012729
Encrypted:	false
SSDEEP:	1536:NO9jvyffWGiHpdYq84Ae89YJTrjz46UNhNnkGzColMa9TJERMCx+Eik0QsAz6iAY:Y9jvyffWGiHpdYq84Ae89YJTrjz46UNu
MD5:	3144EB325CF91713A398CADF793050CC
SHA1:	DF26539AD41F2616F7B19A852058AE1057955CA7
SHA-256:	79994B09E068AF6A30EAD314DCF59D0DD0F76AFB628108CBFB20667EF04487DB
SHA-512:	BFC3BC6AC117435C1F2ACF94417368873502C3DFF6C838273E3BD8D91C394769F2390CA3766FC241CF2533E6593609606272CBF0413ABC75435F1A9AAE4DF2C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................^.....@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	575080
Entropy (8bit):	6.521129188359906
Encrypted:	false
SSDEEP:	12288:VUfve/yP6vdqumz2etG5ePx2Fl5/G3XLSNuDaQEKZm+jWodEEVfKF:VPbl9G32UDaQEKZm+jWodEEBKF
MD5:	80B9E0B8F82ED4FA77504E8542474E62
SHA1:	7A1AB5E2469F66DBB55AA559EEABC802718AB5DB
SHA-256:	48E9CB77BFCC210DA6908410C9D604EE5401DAAFCD18A6EDC8028FFE2296CC0B
SHA-512:	EFA6D3B877E4809E4EA0903EDA6D500E7227EB5FE034163D3E9299CCADAFB41B2D42E5CB00B015F3BFF46BB302DFC9789E8F60C020D1E8C61817D4F47DC6B9DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...................s........9.......X..N......N......N......N......N......N.U....N......Rich...................PE..d...c%.`.........." .....8...Z......0$...............................................Z....`A.........................................2..h...X...,............p...9...x..hN......0.......T..............................8............P...............................text...L6.......8.................. ..`.rdata.......P.......<..............@..@.data...p:...0......................@....pdata...9...p...:...0..............@..@.rsrc................j..............@..@.reloc..0............n..............@..B........................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.506596897827211
Encrypted:	false
SSDEEP:	1536:rO9NAXZqHGnAfUPOMnwjxNK0/84Z1aBBX2dulK0rEyKpFbFK0qA5n0EikpAs9tEJ:y9NAXZqHGnAfUPOMnwjxNK0/84Z1aBBN
MD5:	EB594ED6AAC282A630EC76A6C666568B
SHA1:	CC9405D539AF74D6CBB2907169179B32E2E645D0
SHA-256:	71BAE7FCF4BB8A311A91283AA248782C844D9227DB6E1FE04E48A4CAB14AC526
SHA-512:	BD31CC0E98DA09876A79C0FAC14C0C196AFF161E96765B4AB347208AE11C4E19BAB15D270C319F3ADE3D8B00FC11946DFDCCF6BF2783F44D9E663895017FEFF6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................=....@...@......@............... ..................................................HN........................................................................... ..H............text...h.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..@...................................................<..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60512
Entropy (8bit):	6.489311459832048
Encrypted:	false
SSDEEP:	1536:WO9PR9q4u0ayE7tbVTGDyl5lr41AcUV3tbUe1FdFYWssYYzTRo+0W+zmtq6+D+rn:v9PR9q4u0ayE7tbVTGDyl5lr41AcUV3L
MD5:	BD45CE1BBD7F5130195DBD73AD56E606
SHA1:	5A817D3AF42A2354FC668BCD4FDFCE0DA0D35570
SHA-256:	D02D2FF4F09DDAF6037396B99D25FB1FAED784C6C4CC2170D148E837394BDB52
SHA-512:	64478405C87E625E4870A6ACC183625BD8DDE212B2A09A71A7A6E37C2849296D74A70A1E3C4AB09118BA2C800591B820AA842251CBF2DF87EE8FC99009028976
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................aa....@...@......@............... ..................................................`N........................................................................... ..H............text...P.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......x...............P ..&..................................................."..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.514600219985342
Encrypted:	false
SSDEEP:	1536:MO9NlqiUFxfhZjVqvA/hIlCsOdLM0SB3b6RCJmwc3fF1p3Ruoh9lF7+TmuB/BYSw:59NlqiUFxfhZjVqvA/hIlCsOdLM0SB3w
MD5:	DB3654FF3F605626B6DCD8FAFC855E1D
SHA1:	2438FABB623F8DB213E12B483C050FDC2AC71567
SHA-256:	BAB4A85FD4251CCA4F6DFDE973396CA574D320BA0007BAFB5BAC6617082CD1FD
SHA-512:	24E47F36164742E83DFC58F3C08B1BEA712C92BF51281E2ED310010DAA0028286BEDBD1B9DF4DC6EBA4E77E62A23CECA45128851EDB0FDA222520C67B50AD0AC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................j.....@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.5286663954726745
Encrypted:	false
SSDEEP:	1536:tO9YM3z1nR8zMuKIJycvcygytrpu8hYGNNxYjEF9dmPTKgMsGRissxEikiQsjzpp:49YM3z1nazMuKIJycvcygytrpu8hYGNW
MD5:	2F6D6BF4F97F9FDF61FE4B9247665AC7
SHA1:	30B23726BB0006AC28DDB0D5D2E0B7936D50263C
SHA-256:	C617711C87A7202A62275AAED8BE5CB7BF5EE8AB6C12B18A830B22653D44F1FF
SHA-512:	2F74D1A5003E8F8CF504AAC062BC9F7FA1BFD1E846F8E02DAA5CA6991D576755D83C0B14F90F1BBF6DBDF4B85F5DF945FA4A13DC849982A8BFC31130C6870273
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..b...................................................^..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.512637538205462
Encrypted:	false
SSDEEP:	1536:9O9PD+Ztk6ONWg3iynOs5U1jkFhKwKH/PIPq7tzZtq93YcZ8+gGRlEikIQsVzvAf:I9PD+Ztk6ONWg3iynOs5U1jkFhKwKH/T
MD5:	8C9EB5AFF7D0004D30947C194E25ECC2
SHA1:	959EB3185D0466563B5ACF81D523E66B2159E343
SHA-256:	B99AAD3F2F2318CDD199582B671BC3DC3B3FC6EED93B58197A08EE4DC4F3B9D8
SHA-512:	3052152934E817301E4F9A5B53A025F659BA736895BDB1B5F477F338D4F50DF7E98ABF4F11AE3E7DF614F57B9718A66FD62E44FBA34C4C09F557FA0C8631B12A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................D.....@...@......@............... ..................................................`N........................................................................... ..H............text...\|.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..Q...................................................M..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.492692129735815
Encrypted:	false
SSDEEP:	1536:qO9P3hKCp6OYLZur7K/Wwtzx9RA8YGsBo4bUxOhTeiuQKYGasX2qBEikWwsBspz4:z9P3hKCp6OYLZuXK/Wwtzx9RA8YGsBo5
MD5:	8D810F97C5E04EA5CC87E2C8044D6DF3
SHA1:	80C1EF7C2F54626C96B6B192662FEE0CC0551B84
SHA-256:	D45D72FA2F69646E368DFE35F4796AC0CBF81B1820F5CAA33B15BBD6D9CAFE00
SHA-512:	98FDD764AA6682A6AE434D1FE7202F6E2E776FED3142E4AF069704D05CE35EEC1C0B40BD8210BDE309A3DA1E2C2A2ADEA5D377F71065472EF4C760D434421051
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................n.....@...@......@............... ..................................................HN........................................................................... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..K...................................................G..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.5227816765189095
Encrypted:	false
SSDEEP:	1536:aO9PchEfYkIl57Dr3w8Zw9XS+xd2XHsdlEhm5AtmxhG7TcFzCQOnwxEikrgsmZzp:j9PchEfYkIl57Dr3w8Zw9XS+xd2XHsdx
MD5:	BC13EA7F2F6C6488B93EE84A12A5C67E
SHA1:	128393D9F9B3D6E6C14232620FBAE67AAB45FE55
SHA-256:	29D108F22CE4B6AA310AFF0420DDBE6F085381F4EC5E208E1106C9667CBD8694
SHA-512:	38C7289F2D367D29DB10ADFBFAC21BE26287100CA6F34285B63A3B701694088603192890750BD0DAC5171738C7C1E47AA0A8A2360E7682271695973CDBBC7742
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64584
Entropy (8bit):	6.607514539190837
Encrypted:	false
SSDEEP:	1536:nO9MFcYvxELwVgZIvKsk24cxu1XVwNCMRTid1j2rIgfdqI5TOfHtUI8EikGGLwsV:O9MFcYvxELwVgZIvKsk24cxu1XVwNCMQ
MD5:	5EE803D67F4C341073334A062DCEAEB0
SHA1:	B09E00E0BE185271E40488C9F1C6C4FF407B8C76
SHA-256:	FF8565E4040DFD48EA209456DD7C54F92CC171F3FAEE6235B366B8B8FC14AED2
SHA-512:	C21FDE21097FD9E7E82CBC6F726D2CFBBE3D2B97132AEF6812CF33BA3BD856BDB86EEC504971BB6E2FCDD91A84F4BBC936BE8E02611ADC32E2C79F7A383DF753
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................HN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..a...................................................]..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\runtimes\win-x64\native\WebView2Loader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	151144
Entropy (8bit):	6.290559037571387
Encrypted:	false
SSDEEP:	3072:X/bzlLd3z9vuTuKTVFfXaRg2eslTqEtBOx31dlEEW:td3z0qKRRX9Etee
MD5:	AAFD0A37DD5E306CE6C049D998DF1ABE
SHA1:	C1E60170F45B5FEC06A2708DBE92D6A0EA79F828
SHA-256:	6D4E45818E68B910A35EE49076B7C058795BA0AC06AB9D4F9AE39B72B13A0292
SHA-512:	C4D023CD37EF87C2DD2EC10B996D055E3B9A52CC5EE0AD555CCF5765D2BE1EAC99E647CB975204E3B4C70D776CE5A35E65956ABDAAFAE00600FA89D5FF625D40
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......a.........." ................`@...............................................^....`A....................................................(....`..................hN...p......d...8.......................(....1..8...........`.......(...`....................text...e........................... ..`.rdata..<....0....... ..............@..@.data...............................@....pdata..............................@..@.00cfg..(.... ......................@..@.tls.........0......................@....voltbl.>....@.........................._RDATA.......P......................@..@.rsrc........`......................@..@.reloc.......p......................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.55399526567631
Encrypted:	false
SSDEEP:	1536:frO9gebhHq+ugsPXU6d/ic7SFgw0FAAgWwUT/8IS5RhOYPi5wt7DnTEikDwsQC45:a9gebhHq+ugsPXU6d/ic7SFgw0FAAgWK
MD5:	B04010BB25B1AC49817595E2FEEB6267
SHA1:	DCBDA104C5112E60BD0CE07D114DFDF03A5445B8
SHA-256:	1DACFA2C3100EB9D635E5D6DB5E4F72B451F0175712F62169D3877C454F15B0D
SHA-512:	BCA41D6247A724AC8FFA11A1E6108469DE22EF6B71EB679666C680FB347E1A23FFB5522C8C5E69D061F75C2767E9EC1CED6F8C62814F06497D7FE31EC27D31BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................m....@...@......@............... ..................................................`N........................................................................... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..K...................................................G..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.5077376831024445
Encrypted:	false
SSDEEP:	1536:5O9mF2xWvZr5ttPBV5ramm5IgejsnMniPqhm+HFZUI8L0CmJ67V86o1/7EikS+Al:E9mF2xWvZr5ttPBV5ramm5IgejsnMnim
MD5:	04D6237AAF39CC1B60A8DDEEDCB8B118
SHA1:	81D860BD18C4BC020ECC2C794EE3610FD2DB6F0C
SHA-256:	263411C49C7138CD813093CA7BE23A01F8B7934BED41133DDF5838CBF47EA2FC
SHA-512:	9E775EC5F197921632E9D65D2F25A83F8FD25EFFC3381D6816C3A8A256C28B3C485491D3E20749E4F962EC36D567E0F080FAE2992A60A5571BC580E647E235EF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..^...................................................Z..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.509192080147688
Encrypted:	false
SSDEEP:	1536:uO9ADvQ094ML8I+w2zbtseqNaio1KHc4hUyFE4RlxgCwXVn03mO0OHk0Eikogse7:H9ADvQ094ML8I+w2zbtseqNaio1KHc4q
MD5:	AEEC00A83C3FBA182F9A931A0A0C7F2F
SHA1:	4FEF5D8CFC73550A92036CA984360871E2272721
SHA-256:	651DCA613FB0141E7A0AA256D5856F6114073B344A91A614E68B1DF1F87C887A
SHA-512:	D54DC3B0FF39C213ED771481441C3C7D689F457A6632BB4BE38DC50EBE3970F6CB7697A535AE8296A5789253720A229ABAF2A2129FA4577535E257E1A3829D78
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59464
Entropy (8bit):	6.533113744944594
Encrypted:	false
SSDEEP:	1536:xO9NbIMAwsK92xi/p6ZCXczFy597Zh3ndpqW7A7MlN9XXW0LlTcE56HvEikDQsrA:89NbIMAwsK92xi/p6ZCXczFy597Zh3ng
MD5:	FF9ECD9B097075575B6B0B71FE7C8431
SHA1:	C1D67459FCF36A5DE54FA88A8195F9A41F4F7E09
SHA-256:	F18142E0B49C0BBA9E3F16C45179E5F86372C0EA9199CEB6F95875352ADE5EAD
SHA-512:	CA32500A21F91762C3C8E8C3935C493D780262E5E5DA27E031A7DD1BB410E5E5774202BA1DB4BC7321B5BC64310E1F4F53E31C84FE38937DE1B1CAB6FA8EA5F7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................T.....@...@......@............... ..................................................HN........................................................................... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\th-TH\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	69224
Entropy (8bit):	6.490605086681413
Encrypted:	false
SSDEEP:	1536:QO9f4A05v/3yGE0k4otwhknztUWCH34BsBrs+9XgaCTK6pO3/SNmKWREikrwsmzA:99f4A0533yGE0k4otwhknztUWCH34Bsi
MD5:	3E5B1BCE67D4B752BA5C5849DFAB2500
SHA1:	070C92D43E04F7FE17E617B7885D0E4DA09CFDDF
SHA-256:	6DA0C2FA24300190CBE93EDD1EE7D9D1BAEAAE5FE4E41485FA9928F93190FF63
SHA-512:	9D4A640F9C9D1FC8F1402024F1080BA2BB669BB0522313BCE8D4E9BFD136DED3EB11447866F1856487DF6FA407FBA072D7D7B29F0FC538E7EE676775DDA69B9A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................A....@...@......@............... ..................................................hN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60512
Entropy (8bit):	6.536989118356474
Encrypted:	false
SSDEEP:	1536:5O9gSA64YW8K4MZQ00EOS4Lhq4YFfmKAZ2tWD5WtcRxzkebFbrLyPPEikYAsZIz3:E9gSA64YW8K4MZQ00EOS4Lhq4YFfmKAN
MD5:	ECD1472F7619D89326F308DABA8CFFE3
SHA1:	AC4FE0B2501AF9FE2866F0D028C5FCD56768D431
SHA-256:	9A41DEA86E5298CAC5F601F58BA4100DF330B8C342064ADE82F75C517A3B0CA6
SHA-512:	497CDE74ED8A0F2C264895B27DBA345725EE35D886CF4530A2CFA62FD71A2B2D121A5E0A7900C890CE73EBE539B57B82E71FBD4C06DABCA68397B596770F9041
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ....................................@...@......@............... ..................................................`N........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64072
Entropy (8bit):	6.608282850162704
Encrypted:	false
SSDEEP:	1536:vO97noksNVY4yQM8s8KU9oTU9j6qImAdgM3XRPW+292RK/1BI3HkkKajOhEiknAz:297noksNVY4yQM8s8KU9oTU9j6qImAdU
MD5:	91D5B8C378ABD54B49E001DB04413E73
SHA1:	8DBFE4F8589F584D05330FACEA335955905E090C
SHA-256:	123C3AC7668699DAC8D68E84E31CAD657244E5CB25C698525D1CDD1173D4C0EF
SHA-512:	D0E689C099FF906EEB33B947E59C3753EFDDE762D3250F6A506C54179A2C11813ABCD7F99C7792E8072A6DE7DC6D31D27FA47A138AFCD827EC14A69FD405874C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................x.....@...@......@............... ..................................................HN........................................................................... ..H............text... .... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......H...............P ....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	107080
Entropy (8bit):	6.637040413259322
Encrypted:	false
SSDEEP:	3072:rWD4eUp+HQpcNg0MFdH+F7fecbTUwevPGY:riPUuQpRdUNecbTUPn9
MD5:	A973A87E053354B8E5BCA3940970EDA2
SHA1:	74B0ECB1754C0590AC124DCC838A41FC55B34AB1
SHA-256:	DCC03DB3271E2BF54D44A790119799DF9E217B73DB84578B24B5EC9F082E4BB4
SHA-512:	8E256712E9D0FF1F328ED85BC7418238C5E65D11950411F437733FA9E6E554F079D25F06985BF7E443B2BC2E44B57C272327173566281CFE65CC7D8ACDB16640
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~.[...[...[.......Y...R...P...[...w.......V.......K.......D.......Z......Z.......Z...Rich[...................PE..d...c%.`.........." .........^......`.....................................................`A.........................................A..4....I...............`..L....T..HN..........H,..T............................,..8............................................text............................... ..`.rdata...?.......@..................@..@.data...@....P.......<..............@....pdata..L....`.......@..............@..@_RDATA.......p.......L..............@..@.rsrc................N..............@..@.reloc...............R..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\vcruntime140_1.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	47712
Entropy (8bit):	6.743964781245747
Encrypted:	false
SSDEEP:	768:qdCm5nhUcxgHY/ntXBzxvbT71oel9zu/AmV9zi:qI1z4hx71d3zMAmnzi
MD5:	34798510935FF576CDD2516AFB3D5BF5
SHA1:	98E6CEFC2C6761D602742DC23C024977ED71280D
SHA-256:	AEAE775B321FDD5B2FDF88D4D21F8119C376D6909839671B35D8E03A04F6B609
SHA-512:	F18FB3A2E4A82DF6B025E037D4A730B6985C212936547E0BF19D7AD76D7AA49B06162A773EB99664BDAF1A37932AA2CD35DBBEF83A89BA4C80505E820C3AC13C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8@..9...8}..9...8.._8...8...8...8}..9...8}..9...8}..9...8}..9...8}.38...8}..9...8Rich...8........PE..d...g%.`.........." .....:...4......`A....................................................`A.........................................k......<l..x....................l..`N......<...(b..T............................b..8............P..X............................text...u9.......:.................. ..`.rdata..P!...P..."...>..............@..@.data... ............`..............@....pdata...............b..............@..@.rsrc................f..............@..@.reloc..<............j..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61536
Entropy (8bit):	6.622372328119638
Encrypted:	false
SSDEEP:	1536:TO9gwu6Q6WwlEaDcQwi2kBPcJ5kGvxF825mb6ZB+D31jnVJvWf6Qjlux6+nEikSQ:69gwu6Q6WwlEaDcQwi2kBPcJ5kGvxF8g
MD5:	906FB620C50C4C7EBFF5791603490271
SHA1:	37AE916A56C30D81B9617F8503EEED3992FBC05E
SHA-256:	2B58D9BE8E4F6C6F621AD28F590A708F5EA2C87B03C276AD6BFCEAFC3FD80135
SHA-512:	EE656EC98D1C3CC2B570D8A187B3DC24DB9202812F75372D2A23820870FAA625FCA945BD8D388FD3511744003B236AEC5DCD675945C4E59FD0D3BF51E345F60A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................6.....@...@......@............... ..................................................`N........................................................................... ..H............text...H.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......p...............P .....................................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58440
Entropy (8bit):	6.69454740850101
Encrypted:	false
SSDEEP:	1536:BO9WbWCHB/rkbEqBAVidKSlcZSI3+B0ncFytfjCqpXFBwW8jeFLd8EikKwsOnzex:M9WbWSB/rkbEqBAVidKSlcZSI3+B0nc5
MD5:	CE1AD81DEDBF6F14A73ACEE060E2A1B7
SHA1:	EB494BEB84E84FB1B2F9269623B00CF9D28FBD8A
SHA-256:	6412546AAA0E1C24A8381520DFC495C6F9D7789BB912F8EADD48CC7325035E20
SHA-512:	FDB847D2B021251CEBED07B437420CD94AAB1BD92B60C3873F33F1B68CD9B0D9A0287C34E23087074251629EA04B7B0F5FBB8AC3C530BD6621D2B601AB04375E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ...............................a....@...@......@............... ..................................................HN........................................................................... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..BH.......................P ..9...................................................5..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x64\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58472
Entropy (8bit):	6.707560977053907
Encrypted:	false
SSDEEP:	1536:nO9WbWqDTFAyR6j4hxW50IEdIhR2Ji1paNSh0CvJaCuXaSQCHM7IXLDEiktwsOwV:O9WbWqDTFAyR6j4hxW50IEdIhR2Ji1p3
MD5:	1330C50B0A761AF68E519A0BACD736CC
SHA1:	7CC90128B38291F22A483A6F19299ADACFCD62A9
SHA-256:	C859C796261C20575473A3B7680B0464BEF20F8A0E3C3807F05D4A360A63167A
SHA-512:	BE5290A1384F90FCD564F94FEB2A614768806E224A2E71AC9ABE42289241485781922B406F8D484C0C485FF9778F5E6D43903DB73676C55DC33FD3D87F78C761
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..d.....Xf.........." ..................... ........... ..............................oD....@...@......@............... ..................................................hN........................................................................... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..BH......................P ..\|...................................................x..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\AddinInstaller.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33864
Entropy (8bit):	6.6749170427672215
Encrypted:	false
SSDEEP:	768:bgYy+J05SY3wauWD5Epw9z9gElzEpw9zT:FMcYgauA5Ep4z9ZzEp4zT
MD5:	7F17A972A3F083FC309E93C9ADA8AA10
SHA1:	0072330558FB6E91FE6801DE71ACF06A716BBA5C
SHA-256:	98B6CD35884C8AE37F33196A132D0029100C0BA8AD2EE0C084A4870CFA832214
SHA-512:	D2B924E1BCD5EB260B17CB58E527E87D6FA9E772088F95DF6369599D7C4FFA3866F83D35F6AB333667C129FA8AE9CEE781A46FE8781B37906A60AFC301EC48CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....q..........." ..0..............L... ...`....... ...............................6....`..................................L..O....`...............6..HN...........K..8............................................ ............... ..H............text....,... ...................... ..`.rsrc........`.......0..............@..@.reloc...............4..............@..B.................L......H.......\)..."...........................................................0..y........(......(.....(......(....-..(....&.(....(....,C.(....s....o.... .. .j1+.(....r...p(......(....,..(.....(.....(......&.............ou........{...."..}........0..D........(.....s.....(.......r...p(....r?..p.(.......o.......,..o ......&..........'4..........@@.......0..^..........&...%..\.%../.}.....(!....(.....s"...%rC..p.o#...%rI..p.o#...}.....(.......s....}......&..*........E..Z.......0..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Assets\NewMeeting_Large_120.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1016
Entropy (8bit):	7.73830447681088
Encrypted:	false
SSDEEP:	24:+5DjKVMPFXHX5S4wKHWKWZGmy/xRftEircOiO8UN7O3:+5i8HplNRmKtFPPo
MD5:	E3B1BA3900BFFAE493B4463F9A6FBC48
SHA1:	0BDDCAB7F9537F01900CB7A7AB0FBB1042E460E7
SHA-256:	8FDE3D7378D0E9148068C3A9406D5BD754E93C9810FF5D2B8535FC2B65E0830E
SHA-512:	8CA0A6304BD871B1F2BECCF6AF9CBB2EC97D05B233B9388CFC760B262509B8BF6F9B50B837D21018FCA6E8627FA11AE67F6AF49440A837701B4C9AE920585246
Malicious:	false
Preview:	.PNG........IHDR...(...(........m....sRGB.........IDATX..W[h.A..w.5..4.-..PA....(>@k.\|..._.OA.k1.X........-..a.(..?.)...........hv.w..fw.... .Xf.>..s...@......z...........;%I:.9V.....B.>.;.$.@d.C@.%...W4.K.......).#.....I..u.Fr........8.8....z...UQ......$Y..R.n..#....L.9{.&M.h.6...P"zUQ...a....:.D..Nr.[.u...L.>....K."..'..t/..Yz....--...M.]...e..0.l....!.r./)r.].t..U!.l&...;....i.,I.TD.H......).S...D..P...sV4!.......K.r.\|...... ....Q^.5P.VI...`'.........`...S.Z......?............`......9....g..[.i..Z.\:#.T......2t).b.........Y..<.T...u.`...... \..nL.f.....3A....'7..zDi-....r].k/Hfk....b:......@.k...,D.k...#.j..Z....@<...}2.a:$...Q.vL..u...o.Z..\|I.r?.o.;..".8..{~'.l..fG3...x...W...%V.....h...!.;...gA.$.?F.w..Y...1!..yu.].....fW..>..w..).55b....D7..}.?...._...=.....".+..N.\Z.mup..p..d\y...r+........:..G.Q.S....>..9..[.L.@\|.:..qMP8E.B......R7;....Pk..F.......s...N..F@.B.G...0...e.:....T....d_....i:.........5....].sa^.@!..#....'.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Assets\NewMeeting_Large_144.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1237
Entropy (8bit):	7.788008184019191
Encrypted:	false
SSDEEP:	24:GVwVpPtyAjoNiCkbbtwi0G1UA9WdK+oJgsQ6QVdAmwQATjZWwrpFbVD3r:E6FjowPv70tB/oJgl6Q8mXAT1XLr
MD5:	6974CFC337BF190D728C6824EF94AFB6
SHA1:	741DABA13F01C19518E2E1E72A93DF2C96227934
SHA-256:	115340C0940669C7A55670F03737492FB86D5E34E0390E5664EEA3F9B4147B0C
SHA-512:	679AFA5D417748680624314A6E5FF63CBF37D11BF5E95FD2D2114076F1DCD75196849EB39B1D456A8A5DB0019EF2C4C2FD61EA70651DAF158B87A69D8B017FAF
Malicious:	false
Preview:	.PNG........IHDR...0...0.....W.......sRGB.........IDATh..YOlTE..f.n....Hl].' ..(.1.......$...&....4.&..=.@..A{C...`0.....$.@cz......m....7~....7......%....}...o...H.$.Ow..r..9'.CS...G.{.j...@F..3_.Bx\vc.`xx....g0..&'...m...\...(F...$/2...+.[..%y.(.A......sZ..Z...._.2..V......."[...SB.Y}....%eUV..@...V......G...8.Q....3..}...+.Rq...`]...\.U..yL.V.<.Z.{.1..5P/".&H...5.....D..x.:..m.b.....l..Gl..S.y....."...k.....cX{i.p..pFHtV.8..)....Y...,;U....O,XQ......,.Z.Eq.V7....B.0..b.......Bs.....Z.........}..wp....E......U.......F..........av.#.!.../.......b..rG....E...ZV..W..]w...\..~.q.f.#...K(.2..bU/.L/.b..7?.....6Cg.y.{.R.......9.O..n..H....tYb....ZR.<.t)-c..t..... ..x../....;..D..k..D.....`.J3.d...m..d.LYi&..@3.-l......z.pE.T..Z.u..R..."P.(T......7.%.... ...9.%.....O..p..5..bQ.F..o.u.o.2.B.....l/...1.8-..e....B......\|P.E....vZZ;.Pj...b)..z..r3..s~../B..k6}Z+.."V..[.......T.D.jAU.n1.%f3:.Y..s.{..*..`I.$.....w..T.H...?..:X..OQ...b.N...

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Assets\NewMeeting_Large_192.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1555
Entropy (8bit):	7.805621612269991
Encrypted:	false
SSDEEP:	24:xyPSt6BuLqrVii+xXSCLqmgDvjUEAkgoX1Amyz/zaY6pGtqPgmeAkG0ZZz:cPSt6G2iimqm+6kgDl/t6iEfGz
MD5:	177094A528723CEF49FA2FFDFAB57CF5
SHA1:	CBAE150EDCD83F2E9BB87A0BB86CF076EEBC41C2
SHA-256:	66CD5E3CFC69AF5087D33C570CFE424B50935B01C27E618CA11822AC7AE6D1E6
SHA-512:	AD9394116D2E132EB2BFF48F1AE4AB7AEC5B372FFD2B7B41E29CD8BF26C87725BB48D0C3AD85F7C3C94B4556872A06876D1E95F4AD8A0CF63DD949DBE350D8E8
Malicious:	false
Preview:	.PNG........IHDR...@...@......iq.....sRGB.........IDATx..Z]L.U.>..,.. .[)6<..b41.`..4M.>h..........&.H.l.Y_L..6..&ZiS./.'1....X...F)....dw.z.....30..:7......9.g..@.........n_..V.........]...9F9.?..2C6...u.h.#.....?..19...U&....P.@_.R.#FY..&....P2~.....~..J..(../...I .y..Q.R3....Q.y....a...8)cwv^.-...?..6s....\|....'Z.e:.4_..w....).Uz./\..........pG......N<...1.;..X.XO...a.../.OS.._.).... ..e...dz........\././...u^..-Q.'..R..D.l...._1.5..G. ...t=,a..Bbz.+$J.BNB...V.&7.3....&,..Y..u..0w....}.......v?wv....TF-vN..&&f,..\.#5.....6=..p....y{3...m1....X.(.-VjqO..S..u.x...e..,......3p..."..`..@..0U.d.Le.,......\|.....A.d.f>.......m.....{..T L......kD>.....K.....4Qv....J=...o;[...4d. .....O.S_...I.y.....Q.\..><.....8......r.T.?3.eK.......b..~.@9.....ll......Pkyh...n,m..o.\..&.ai)YJ>E.......I......rWG.tu..ftl.^..R...O.Euu%.....&&K.......Hp.Lx.......K....cE.,a..`.1....i.h.5..!.......7......u.OP.n.[o.A...;.6....".&..o..v.4(34tj......U...C...u...S.N....H.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Assets\NewMeeting_Large_96.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.630755600269692
Encrypted:	false
SSDEEP:	24:L9IW0j2BjoUb25MCbt+OzOGKynRHS/0psG7:LaW0l2Ut+ONRy8+G7
MD5:	FAFBA571265B20E0EC4423FEAD972E1B
SHA1:	B686D74FF48E3B990F0E312BB0F3AF4E8F53069A
SHA-256:	1FB3B4832E92B1E2F998CD2FF4A872000822CBB897D869194195E5C4F8D43CD0
SHA-512:	D0523CCC27436A80C5A14094AD244349EFE68FB5A813F97539C3025FCC1F05D6CEC9B8FFD04883E35BCD787A36901246687162B4B86717E81E747B2CF035DD2D
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB.........IDATX..VMh.A....i..$-j...C..M...`.T..A..,6.VYj.T..(....=.^...E.....b...4i$.I.....n....<5......y.fv....ZM.z7..Z..QB...t.V..cj"...gK...e........YI.>?$.V.^......ZF...av..cn....Vi.]P.(..).v..Y.P..s....D./n&YpJ..iG....8.Z:..._.......................~3.......Y\.T...H.J......n....c.p...x.n:....i>....i......i.GvLd....SRx5?.....3G...3...i....th.5...._..CGy.....R..q.I.>....\.e>x...#......v...L6OV....uR&.....o.#...y6...c...r,..#...B(..e:.K.6..:.r....+./....g..@..!....N.....=.H....#.....j.K..F.&6Zk..."......d....].Vl...IG.......:...]w$p.+...4.......k.j...$.ja}..x...(%.x.9\|..a.d._0sy..>oL.....%<.0.C.....;..(.!tpb"...N.R.Nj..?.."...RH.......8.Gb.P.i..y.L..OMv.Q.o;....[.sQ$A.8}3..cn.!wn.N}..m..#x.'......jV...T.G.?[..3.)......X........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Assets\NewMeeting_Small_120.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	574
Entropy (8bit):	7.347738166641519
Encrypted:	false
SSDEEP:	12:6v/7iHKcqzpeXnDvyEqCcmpZndaYcfyYCta8eq0NRFWBOfmcN274Gl2E7:6cqFeXDvyEqEpZdaYcStx0LFgOfzkUD+
MD5:	503E86E4628933D17B5B41B4918D6C9F
SHA1:	F884F45CF4EF5B435E554EA30F654F076E50BDF5
SHA-256:	1C80CC98643E1D060B9443C98E9AFE663125398F7BB99E5BAB2C0EB952C9C111
SHA-512:	22D115A09597F7A8CB0C5BCD0E0BBA55798D3A431B28EC27E9DDAA356BF0AF674BDB78E6D9A3911E2750354D42A8AD628EBD0A7716410360F6D1160258E12C98
Malicious:	false
Preview:	.PNG........IHDR.....................sRGB.........IDAT8.c`.....:.....o........'XX........K.&.2.....`>........}....Y ...Li...n.......K....103.1pq..u.].. ...g........`..C.^.......w...~20...k..4.....d>....0.Bv...~.....>P...A.dddx.. 6L-8R......lY.....>!{..k]8.._@.V.W..@1.&.2.f.L...S..f..L.`...'...Oa.@....f../#.....d........G...F!..c.U..-%..q!#.5d].V.G.2.........$....k....Y.....=V.8......8S....#J....e I.YOQ..)0.(.L`..`db.q............4\|.(.s.H...,....Y+a&..r...D:aecm...&..q....Q{..[#.+.a.a4..]b.B.`\|d.g...c..j-..L..@\|../@'...........".D36.@J.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Assets\NewMeeting_Small_144.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 24 x 24, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	627
Entropy (8bit):	7.55832772949955
Encrypted:	false
SSDEEP:	12:6v/76fR8ZKPil+HE3xZKPwUonTJibKpwwCzc8oRNn/Dna+z:7R/PUsE3xZ/zsbKpcI3Dna+z
MD5:	75713D844925AC3404D59C5D56DD996A
SHA1:	88F0F5B5450772A85FD61FB5FD54C3A6F7E48585
SHA-256:	D4746496079E9C334715958852FA8FB59E54DBDEAD19D83001FA15C1793D27B2
SHA-512:	B60E132BD5251084B2C7A22591D72DFDFEBB7A24987ADB8E78CA345694F6043C1F3C7A9205B6052CF3846FCF33179506BFF88C1D1BC8093A7563CF150EC5D30A
Malicious:	false
Preview:	.PNG........IHDR..............w=.....sRGB........-IDATH..TAKTQ.>.7.o&.Y.e...ZhJ..\..-.6AK.@...b.+.h+.. .].m.pg.m.. "....7.x...;...6E.....\|.\|........&.@..../.....A.[..}...p.Y..Y....j(i_c<)...X \.nq)......OO#.........I,......-.....].4..d.!.....,..Q...vu.-PP.........\|.Q^t..@.^..dQe....^/y..'....mA....o.h.....t...x.........A..?q...>....<..#g...S .\..kko.\....l.).L.L.7.l..!KwbP.?" ...?,.w.q-....y.".\|.O....Y.4..^J....sC..Z.;~..R....8)H..p.....L!.......[^k.+.u..w.4(.1.Z..q..G.AM..{.gj..L.b.\...\.m~..N.<.f..........Y...K0J..E..^.....D)?..c,.../].p2..1.2.D_u.s.x}...?TL.?~..;P..(.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Assets\NewMeeting_Small_192.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	875
Entropy (8bit):	7.664401472706693
Encrypted:	false
SSDEEP:	24:MnF5WncYHQTt0feBgmzpRjRqgnoEmDDxM4xr8LTdIDg5X:MFAncIQhee+mdlRlTmW9uDg5X
MD5:	F323D73771349B6374462B8A4B708D83
SHA1:	39F8860AEC7AC9FF8DF80C770A23F3AC8C3BE4A1
SHA-256:	EA0327CD2D987CF069747F70A317E552C0304170177101AA578F04D2EBE9FFB6
SHA-512:	5377FD3886FCDEF87B61F1CC825655E6B977E370563B2C2F7B3BB675B8ADCCE621A47F056945A9C0A41F9C10BF4DF6694167E62A310B146587F898D39E753EB2
Malicious:	false
Preview:	.PNG........IHDR... ... .....szz.....sRGB........%IDATX..VKh.A..I6O.H..$....../Q."....z...x. ..."X..`OR,.C..Y.h=."^....Q.U...ib.;..ufg..d7.P.......?.L...p....Lt...-.P/...^I..X4.X..........A./&..'%'.k.....,..\......l.j'Y1f...L.....~p.?n^..N+6xF..^}...3...`..(MN..Q.H.0^`XCG.^[z......X..0r..\E.n(..@..b..#....._....\..=.,...#.7.....t.x......I.$..-..W1F..o..Q....x...P)......S!......v...zd......+...#...O.....Q.........!..2...$....p.X....g.5....e.o"..V..yQ..I.a<9?..\|.t...Z..O..Bv............Z.........r...W#...-.`.(.0.Alkp...7a-..../....Mt`.g.......4.].5.z.X.Z...gz....R.S......-.1.w`a.......<........"..E.4\|.X..T...no.M0./..F..k.P.uW.].f$9.pY&......Un..N.3\|.......`.....2..e....C......r...g.Oj...t..`..s...PE.].v.,..S.J...P@u..q........[G..0..0...9..Z2].u...\|......Ru.......}...6...W&z.4.S..0\..K....n.@a.Z....(..9.........3._.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Assets\NewMeeting_Small_96.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	483
Entropy (8bit):	7.310129121242215
Encrypted:	false
SSDEEP:	12:6v/78zmIphkxF+oabzkBMDRbuyP+3uvNg9e8lJD+SF330YN:46m0hRl+3q+nD+SiK
MD5:	A2761DE768472D09D1E02C92EBD144B5
SHA1:	60BA18F0FF47B9E9C3E23B5AE9E95E3D319B5C5D
SHA-256:	AC7FE3232888BF96C520D586C723149CD3127E1CE7CC65BC35BA1984CC27BBCA
SHA-512:	F330DB55B79E561D2DAC1CD051421F91D6981A489A004EB0EAE3AE090B1386DDF46EFB675A9B6F75A0BB83F741B5DA12E4DFB872EE41782773BFAEC9014CA667
Malicious:	false
Preview:	.PNG........IHDR................a....sRGB.........IDAT8.c`..0..?i.......e....?#.Nq>..<...Y..`.W...00.......?..........;.jX.=6,4....N.\|~....._...K1.....A...l....>.{..m....2........;?...<.......\a./.tA.H.?... .l..f.......s....p...V.KB.x.D.)2D.)....l.}........`.....u.!...7,7....H.O.^.B....?..`.D..2...C..e$..:...7...B.`d`..R..D`0?.....~G1.?....KFF...L.. I.(.+6..z...).....d......5.h..q.+.2..,( ,W%-c.....Y\R."........Y..... ...7.@..?..-....JkZj.w.....e.........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Applications.Telemetry.Windows.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1626208
Entropy (8bit):	6.836593084030771
Encrypted:	false
SSDEEP:	49152:FiooDWLdfZohLu+Qzv53gyYq/t1CjQaLOGwkR2HwMuTwbXjBWQ1KLgKRw4jZh:Fioo+dfqL81//Ijt
MD5:	56782B45762DEE25B58E68D574A91468
SHA1:	B36B5BDF938132CDE279F555C3F0FFC58B17C540
SHA-256:	19071E7F9D27FE8E766456FA5224A12588DECDED12AE305A082A5BD48E3D1CB6
SHA-512:	1161162EF540F5D327367BCE65B39B1154916FF8D36464FF571F9D7D70F9572E48FDFC79B467917792629AE0B4F5B787798858B09370D36BB837D9A1D5D4B9C3
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......&..?b..lb..lb..l\|.Xl`..l0..mi..l0..ml..l0..mf..l0..mE..lk.Hla..lk.XlG..lb..l...l...m ..l...mh..l...ml..l...mc..l..4lc..lb.\lc..l...mc..lRichb..l................PE..L...76=\...........!.....l...........n...............................................T....@..............................O..@...........................`N..........@...8...................`:.......P..@...................T...`...tR..H............text....k.......l.................. ..`.rdata..Z............p..............@..@.data....t...P...Z...:..............@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.JsonWebTokens.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	78408
Entropy (8bit):	6.129481246167649
Encrypted:	false
SSDEEP:	1536:nm6516C0z6v8JyJNPk2DuttJ6gDEkeLGzewZGLzw00f:nmqEC0zhyJNPktDXiGyRv0f
MD5:	EEA13258A8B7DE541A74D2912769F2A7
SHA1:	542082376A88F30ACAE47D71737A043A05334B1A
SHA-256:	E4FA6AC046B919137158954B182A647129990B70399C9894CE6918F0FA893262
SHA-512:	A8E7A6F7476867199D2E499ED09F11742593B398FAC4B4F3CA9C2D3496AB2A1B80A5E439F4444342D0A30BB3C74FB1A616E508DD05BBAAF6E54681F5F56BF8A9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....{............" ..0.................. ........... .......................@......D.....`.................................Q...O.......................HN... ......T...T............................................ ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc....... ......................@..B........................H........[...............................................................0..v........s....}.....s....}.....(.....(....,.r...ps....z...@...%.....o.......i.....i.3....(,...r#..p......%...(....s....(....z...0...........s....}.....s....}.....(.....(....,.rd..p(....z.(....,.rr..p(....z...(....(.....!.r...p......%...(.....s....(....z...(....(.....!.r...p......%...(.....s....(....z.......C..Q.!......s....!....j.(....r...po...+%-.&~....j.(....r...po...+%-.&~.......0..F........(..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.Logging.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	41032
Entropy (8bit):	6.710594759580758
Encrypted:	false
SSDEEP:	768:vS0Nb06pBrs9OoJu8Gw1OQaXV9zPgEllVXC4dC9zVj6N:vnb0NO217GnzPZ/C4dezF6N
MD5:	E6F3F341BAEB31F4196C3085FB34F767
SHA1:	D78EBC71D36B06E0DA7FA41E6D7888FCC71042B6
SHA-256:	4BE875B73CD50A95A1480FD3330222C278903DCFA9EE73263198D860827EA9AF
SHA-512:	A38A81B096D215E04947BDD2E7D1532E676C8E84DD9CD598D98EE5EBF5C1197CF1AC690F28DA0EAB3DC1CA42CE0CD9F1EAA0901E7CD55C1ECA927D86E880C365
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...[c............" ..0..H...........g... ........... ....................................`..................................g..O....... ............R..HN...........f..T............................................ ............... ..H............text....G... ...H.................. ..`.rsrc... ............J..............@..@.reloc...............P..............@..B.................g......H........,..x9...................f.......................................0..I.............r...p...........r...p.....r...p.....r...p.....r7..p.....s.........:.(......(.....~.....~............~.....~...........~.(....,...(...+(.........(......(....,..,....(8...(......(......(....,..(.....2...(...+(.........(......(....,!.(.....2..,....(8...(......(......(....,..(.....2...(...+(.........(......(....,!.(.....2..,....(8...(......(....*..(....,..(.....2...(...+(....

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.IdentityModel.Tokens.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	937544
Entropy (8bit):	5.838809981110096
Encrypted:	false
SSDEEP:	12288:uMt+vIZDreuKQvgXyexT4Yn2sxGwmBgjoIb:jVbgXyeV46xGjBgj1
MD5:	528D783F83C540EFC5F138D21E8C1696
SHA1:	64F87F45719CA06143AA6328A52E6A96285DA63A
SHA-256:	CE06CDE2B771E6E215CA9A10F8739A23AB2990A53C32301E42838D40E8E355F3
SHA-512:	ED2562BE767103C2FD7179B0F632A2250F8EF97950341C6D0FE6AC8BA347499682CF7201289169855F313D47833F863FCC110B54864A8BBABF046FFD8B5902CF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....o..........." ..0.................. ... ....... .......................`............`.....................................O.... ..................HN...@..........T............................................ ............... ..H............text........ ...................... ..`.rsrc........ ......................@..@.reloc.......@......................@..B........................H........0..X...................T........................................(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{.....3...{.......(....,...{......{........-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..o....aX...X...o....2.....cY.....cY....cY..{......{...._..+%.{.....3..{.....o....,..{.....{......-....(.....0..H.........{...._....{......s

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	252512
Entropy (8bit):	6.362389658905794
Encrypted:	false
SSDEEP:	3072:yDooTOC7Qc83rAUPtqy/KOak1VLsJYI52ZTG1h7iriwV3nm:yDoor5+lqyCa5sJ/7imAW
MD5:	7FEB8740803639B2D4F945032AD5AB35
SHA1:	1A96043B957A544D2A683A9F34273B3D4D410176
SHA-256:	7AF7AB8BAE45CC39108640B02BF864A0923EA9249C11D11DFDB375ACCE6A5787
SHA-512:	0469C31C0BD093C46FE6268B1EB6FFE512F198C1EAD0B4D463072F2C0F5AFE7A09A4C80F8FBA89714B2B54DB3C111AEF066FBE0D862EF2C2EAA86E8D4E5DFDA2
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........iL..."..."..."..p....".}&...".}!...".}#...".}'...".p&...".p#..."..Z...."...#.w."..}&..."..}'..."..}"..."..}...."......."..} ...".Rich..".........................PE..L.....Xf...........!.........r...............0......................................;.....@A........................@.......0...,.......pj..............`N......P(......T...............................@............0...............................text...:........................... ..`.rdata.......0......................@..@.data...............................@....rsrc...pj.......l..................@..@.reloc..P(.......*...b..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.AuthLib.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	40520
Entropy (8bit):	6.639030202064737
Encrypted:	false
SSDEEP:	768:oom7dmnAf1mkMF51ap+v/7pKK4gKK9zNEgElAVXC4dC9zVj6YM:aR+aps7pfNfzWZ8C4dezF6YM
MD5:	B05D496887FE2A9E6EB1B054D7C67FD0
SHA1:	D67E9867684EB6ADC456A8A12DA59A043ADD9F63
SHA-256:	B66E0755E36F168AF5AB5EBF6FC493FFC6ACF322DF0446DBF03D9531F1ADFE81
SHA-512:	2C5BD0172B2D9B7CD629B22B25E7C7A1FF19BFC7A831F622E7A388AA4D9F2FE3F2A6D2A48F5BFB81B727BEAD80B07A07F5C9EA1777747EBBC46E806398223D2F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..0..H...........f... ........... ............................../d....`.................................Df..O....................P..HN...........e............................................... ............... ..H............text....F... ...H.................. ..`.rsrc................J..............@..@.reloc...............N..............@..B................xf......H........-..t7............................................................{...."..}......{...."..}....V.(......(......(....~.(.....s....}.....~......}.....0..+..........{....~....(....,....{....(.......(..............##.......~......0..........~.....r...po....~......!...%.r...p.%...%.r-..p.%...%.rE..p.%...(....r...po.......{....~....(....9.....{..........(.......{....~....(....,r(....o....(....rc..p(....(....&.....(......~....(....,+....}.......(....&..@.(....&. .....

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.Diagnostics.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	33384
Entropy (8bit):	6.800503141051873
Encrypted:	false
SSDEEP:	384:Vd5BNiiCEvdA5LfyacHbZTmwBWYsQWRCs1MR9zlN5W2pM/NEHRN7b2IR9zgRqt1O:VdrF05xwn0U9zl+2pIAKU9z/0
MD5:	32743467628DB11AC5AC9C7BECF72430
SHA1:	26FF39C01012934345C3FD4B156CEC0BD240941D
SHA-256:	79906800C06A9B80BB204233EBB7EF05168218C687B47E7AC1DACE115A028CF1
SHA-512:	09455FAEAF0E21D1E6C2A5413C259AF8AD44E674B9EAA766DB9CB4C71A659B3E77177C52292B67983900AABFCF8B5A31FBADD4FB711A72D8DFE5A1EDF24B5C2C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..0.............I... ...`....... ....................................`.................................PI..O....`...............4..hN...........H............................................... ............... ..H............text....)... ..................... ..`.rsrc........`.......,..............@..@.reloc...............2..............@..B.................I......H........(..P..............................................................-.~........-.~.........0...........-.r...ps....zr...p......%..o0......r=..p(.....%..o1....$....%..o..........%..o2....%..o4....%..o6....(......o8...,..(.....o8...o....(........(......(....../.rs..ps....z.(....,.ry..ps....z..}......}........0..Y........{....-7.{.....r...p.{.....$...(....s.......%.o......s ...}.......{....o!.....,..s......F.{....%-.&("...r.(.....-.r...ps....z..}.....0..0.......

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.MeetingAddin.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	1097800
Entropy (8bit):	5.792143415990996
Encrypted:	false
SSDEEP:	24576:AH7EkgPiZ5Bsu0G179oVVmfLEq2awGQUZ:a7EbXs79oVVmfLEqNwG1Z
MD5:	257D3AD395C9CF96B0B06DE7AF86959B
SHA1:	B6C9A1E7EB119C7A8FF4FA0F9D3FB96DAA7E25FB
SHA-256:	D6E3E4C181A50F751BF0ABB51E9F678B8A670144C7ADE4DB99103A2AFE9FFFE8
SHA-512:	061473D98CF2397607CB83EB59F49F028D2441B1F18E11B64F096E3FD2FE85D8A400FCC9CF60CA7C596218BED46CEC417ABC16ADBAFC899DC678977AE58D5A4F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..0..h..........F.... ........... ..............................w.....`....................................O....................r..HN........................................................... ............... ..H............text...Lf... ...h.................. ..`.rsrc................j..............@..@.reloc...............p..............@..B................(.......H...........H............................................................0..%.......~.....r...po2...~3....~3....~3.....sM...}.....{....9.....{....oZ...,.~....r3..pr...po4.....}....+h..{....sd...}....~....r...pr...po4....(5......{....(...+...{....(...+.~....r...pr...po4.....o......o.....X.~......r...po7....D.~3...(8...,..(9...&.~3...(8...,..(9...&.~3...(8...,..(9...&.(:...&.........."..........."....D......(;....(...+.....*.0..C........o......o......,..oa...(=...,....o....+.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Teams.MeetingAddin.dll.config

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	515
Entropy (8bit):	5.076136391837345
Encrypted:	false
SSDEEP:	12:TMHdGzNFF7ap+5v5OXrL/2/tFicYoKV7VirkTyxm:2duPF7NhOXrT2/H9kirkV
MD5:	ED080ED5825CF4893CA4F7D1395B9957
SHA1:	3905E190109E5DF90676F4716A69C815A6E52B44
SHA-256:	29F368DEF465F1AE30DF31EBCA4A976F180DBCF3718605B4ACB0D6DA95A30855
SHA-512:	73041863B7916B21A56D5C61933D9922D24B15548D7356DFEE42C3AB617F72A04AA8080F3C5EB3F21D968FFB38C7244D4484E78540BF6BB8FC93600A017E43D0
Malicious:	false
Preview:	<?xml version="1.0" encoding="utf-8"?>..<configuration>.. <runtime>.. <assemblyBinding xmlns="urn:schemas-microsoft-com:asm.v1">.. <dependentAssembly>.. <assemblyIdentity name="Newtonsoft.Json" publicKeyToken="30ad4fe6b2a6aeed" culture="neutral"/>.. <bindingRedirect oldVersion="0.0.0.0-13.0.0.0" newVersion="13.0.0.0"/>.. </dependentAssembly>.. </assemblyBinding>.. </runtime>..<startup><supportedRuntime version="v4.0" sku=".NETFramework,Version=v4.8"/></startup></configuration>..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.Core.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	295008
Entropy (8bit):	5.771512173166689
Encrypted:	false
SSDEEP:	6144:6ylhq4ugopeh5eBeGNx8cNe+zcee9eoedTeeIzeqRK0e6eR9pRFIEIEEICepM1Sj:2P4eR9pRFIEIEEICepM1S2LQQs1hP19x
MD5:	D3A3E82247F81342E217C92B9C89BC86
SHA1:	CBD914785348331AE68528ED71E317ECADDC10DE
SHA-256:	B39CA19017B8B99385A588433B4AA1CC87DDE272DA14771A9750F00605D31091
SHA-512:	EE5968A216BD402632A0CA1073B8C4CA5303CF28F30002AAAF2E7590B565FA3BF951E7B62320E4E3592DE50B9F56F08ECADCF67B50659DF056BB5812388A962D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....].a.........." ..0.............H... ...`....... ...............................b....@..................................G..O....`...............2..`N...........F............................................... ............... ..H............text....(... ..................... ..`.rsrc........`.......,..............@..@.reloc...............0..............@..B.................G......H.......L9.......................F.......................................0..G.........((...}.......}.......}.......}.......}......\|......(...+..\|....(.....0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......rZ..p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....................."..}........0../........{....- ..{....t....}.......r...p.s+...z.{....*.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.WinForms.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	45152
Entropy (8bit):	6.663371468091526
Encrypted:	false
SSDEEP:	768:iTFfTl1XWYTACPHZDgcE05P4Jjrnh2jwSosuTv1JKa5/Zi/6LsubsOzMnXbD9zMz:iTFbHXLPHZDgcE05P4JjrnawSosu71Jh
MD5:	F86AFF1B72BF70884B4BE0CA38919369
SHA1:	8D3DDF77DE94F5EAE244AD09F9D2ADDCC2DEF709
SHA-256:	69B2BBF16659F98D589942A1A3F344550DD1E03446DF4F81DC4668F1D51CFEC0
SHA-512:	718F629F907EDFADFFCBCA135DB6153B2BE001E450940722B43C16279CF9ED0A6384D1205D3287F397B2E8FCD9A5615BB2497E8717B6CF6391EFADF1BB122480
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...03............" ..0..X...........v... ........... ...............................B....`..................................u..O....................b..`N...........t..8............................................ ............... ..H............text...$V... ...X.................. ..`.rsrc................Z..............@..@.reloc...............`..............@..B.................v......H........3..T=..........(q..@...ht........................................(......{....>..}......}......{....>..}......}......{....>..}......}......{....-%..(.....(......(......s....(....}.....{......#.......?}.....(....}.....(.....(S......(..... . ...(......,..(....,..(....,...(.....{....,..{....o......( ...*.0..>.........( .....}............s!...("...........s!...(#....{....,..{...........s!...o$....{....:.....(#......H...s%...o&....(#......G...s'...o(....(#......J

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Microsoft.Web.WebView2.Wpf.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	50760
Entropy (8bit):	6.631383698123452
Encrypted:	false
SSDEEP:	1536:0X0t7C3ZK8wDP/ryEH0mBO4JjrDXaUfUPLkIFKKa5/Bi/hGvoAwWKSVdxxzXZVP/:0X0t23ZK8wDP/b0mBO4JjrDXaUfUPLkR
MD5:	04B900A20C71F7A23BEBA77F88B86308
SHA1:	C5BCD7AE974EBF89F6D12F26DBAA9B4FD4CF2A53
SHA-256:	BBA041B5BE0946EAEDE57AE31361844CA781C9FAE80607980465C7F2422F83BD
SHA-512:	F40B2ABAD653F4433D8B7C665D37000780D7A1289F4B187F8B51CA7C8D577C7D7449A5E12C0DCB1FBBFC45403437D6F9F4AD09CA326239C4D1823908063CE19F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...8............" ..0..p............... ........... ..............................8.....`.................................9...O....................x..HN..........d...8............................................ ............... ..H............text....n... ...p.................. ..`.rsrc................r..............@..@.reloc...............v..............@..B................m.......H........;...M..............@............................................(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....F.~....(....tP...6.~.....(....6.t.....}......{....-%..(.....(......(......s....(....}.....{......0..........r...p.P...(.........(............s....s....(.........r1..p.P...(.........(............s....s....(.........rO..p.P...(.........(............s....s....(..........(.........{...."..}....&(.........{...."..}....*..0......

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\Newtonsoft.Json.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	714312
Entropy (8bit):	5.981067761075983
Encrypted:	false
SSDEEP:	12288:H9BzaPm657wqehcZBLX+HK+kPJUQEKx07N0TCBGiBCjC0PDgM5j9FKjc30:H8m657w6ZBLmkitKqBCjC0PDgM5
MD5:	D473F50D1D29B975DA5B6EE0BE8DAA16
SHA1:	AAFC94D3C26041CCA3737FDF6240290DBAC1388C
SHA-256:	E57E1BD98CF3EB35B61BC5603DA893DD8018BE8CD6CC582D263CD964CE1E47DD
SHA-512:	1BB89EBE3EE9D61ECD194ED008C25733C5888FDBDE41A3D248161EE4A708526489A2F79D23EEE97CCAB0D58622ADDE158E07225B8A64AD1F6593CF848206FACC
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L................" ..0.................. ........... ...............................Q....`.....................................O.......................HN.............T............................................ ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H........{...,..................d.........................................(......(....^.(...........%...}....:.(......}....:.(......}......(....:.(......}......{......(......(....:.(......}......{.....(.............}.....(......{.....X.....}......0...........-.~.....~....X....b...aX...X...X.+....b...aX...X...2.....cY.....cY....cY...{...._..{........+,..{^....3...{]......(....,...{].....{_.......-.....0...........-.r...ps....z.o......-.~.....~....X...+....b..

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\OneAuth.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3764832
Entropy (8bit):	6.859369138253314
Encrypted:	false
SSDEEP:	49152:HEERDAD3OE+TYoUjYnjglMZqCo8q4T3Ka/Z+fsh0EGR+hmahbt3pHGiOTYHf8P8c:HEERDAD3OFYoU8jgGq1V4TaHviOTY8
MD5:	C0A14FE8511CF67D40BBC606EFF12A5E
SHA1:	9E1A3183E9FDAE57B59C8A5B7A8D86360B175B42
SHA-256:	E1B7188C8F3713C188C4B9F3318EB72614C498493342B169234FBDE7FD2DC0D9
SHA-512:	4AC4BCF33E039F2404E088FE7E55634F032109EBF53A5EC851525DE75B4116D29CD75D29B186212DF305F6467A47F18D6C6190632FFC0D736C4FD7BA112F43D7
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......$...`..`..`..2...d..Q.G.b..2...k..2...m..i.).n..2...M......<..t...i..t...a..t...s..`..Q......d......a....E.a..`.-.a......a..Rich`..................PE..L.....Xf...........!......&...........#.......&...............................9.......:...@A.........................05.$...$15.\|.....7..............$9.`N... 7.4R....1.p...................@.1..... .1.@.............&.T....#5......................text.....&.......&................. ..`.rdata..$.....&.......&.............@..@.data....H...p5..2...V5.............@....didat........6.......6.............@....msvcjmcm>....6..@....6.............@....rsrc.........7.......6.............@..@.reloc..4R... 7..T....6.............@..B................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\System.IdentityModel.Tokens.Jwt.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	94312
Entropy (8bit):	5.905204811037498
Encrypted:	false
SSDEEP:	1536:erLOBZPOcQY5bOfk4GftC07uktN9XNEgfpXaXr0iMJgBGILkDzVZl0+88niFF2Gj:eeBZPOcQY5bOM4IuktN9XNEgfpXaXr0s
MD5:	A70D021C422B844D5B3708A619466057
SHA1:	5F63C78F20FA7E7ACA36C91F209D4215C854C90A
SHA-256:	5692B8A4E74EC8484A87D68379FC69FC119E980F79D2765F7FCA5BF5FA302024
SHA-512:	A8CDCC3043376A1D25B318739DB7545CCB0ED77C1E134CC03B5A009A655EA6861EE3E7246EBDFFA6D53B6BE31EBFFF93B34322488C1067712F0A280ED2B8ECB3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....g............" ..0.............*7... ...@....... ...............................-....`..................................6..O....@..............."..hN...`.......5..T............................................ ............... ..H............text...0.... ...................... ..`.rsrc........@......................@..@.reloc.......`....... ..............@..B.................7......H.......4_..0...................d5.......................................0..........s....%r...pr...po....%r...pr...po....%r ..pr,..po....%r...pr...po....%rG..prU..po....%r...pr...po....%re..prs..po....%r...prs..po....%r...pr...po....%r...pr...po....%r ..pr(..po....%r...pr...po....%r...pr...po....%r...pr...po....%r...pr...po....%rr..pr...po....%r...pr...po....%rN..prd..po....%r...pr...po....%r...pr...po....%r...pr...po....%r~..pr...po....%r...pr1..po....%r...pr...po....%rm..pr

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\System.Net.Http.Formatting.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	189544
Entropy (8bit):	6.2575053993527705
Encrypted:	false
SSDEEP:	3072:MXWun8Jw8fCk/Dvf5eso7DpGbG8pwp2xuRLYs8jn4xo:MXWu8Jw4L/D3UVVGbGbd2
MD5:	8FBA542C86765B116FD3B6A397196984
SHA1:	47D65C9D0C0D07C4E76F3516C90E7FD1CEAC1B0B
SHA-256:	7E0C5104F49C2B79E0261BAB191CF7ED25BBE9C01BCB7DCEDAE5C6AA1F8BA94B
SHA-512:	89C05EFE882C226EB55A0D234BE49E2D4D639DB08FB0BF85129E672CE3773EFFA82E7F95EDB1F7DE1F3B8B57B38203AA69E8B84CB51885A9CE9918332DC06D22
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...c..[.........." ..0.................. ........... ...............................L....`.................................D...O.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................x.......H.......D...@............v...3..........................................R....s... ....(....F....s.....(....>.... ....(....*..0..d........(+....-.r...p(c...z.o,...-(r...p(...... ...%......(-...o.....(^...z.-.r...p(c...z.-.r...p(c...z.../.r1..p.............(g...z.o/...rG..p.o0...-'r...p(...... ...%..o/....%.rG..p.(^...z..o1...o2....>....rS..ps3......}.....o1...o4....+E.o5......s........s6.......o7....o8.....o7....o....o9......o:.....&...o$...-....,..o#.....(...+:.....o<...s

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\adal2-meetingaddin.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1443936
Entropy (8bit):	6.527875057204511
Encrypted:	false
SSDEEP:	24576:lTLWvdxPRBVcPrV/guppMXb1xaKbtQnVfAEwCnCnT+XgFz4a0of+IJR2:RWvdxPRex/hpskKenVfA8nOT+wFzL0oo
MD5:	7B6F85665FC19F835F60DCFD446EEC8A
SHA1:	14FF072047A82CD3259D5895F9EEEFBD7F243F35
SHA-256:	A7BDE8B9A4073473A28DB5ABE3C12ADDEC08CCDA516F2DC79A79F3BFFFEC5208
SHA-512:	2BBD7FE67DD132C8029504F0BC5E50396A0BC26BEB3D705E11F04A12FC13334485345170B72567C9A865227B55E53FD21712CB34231C6A72ED5A96D992017A44
Malicious:	false
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......K.t&...u...u...u`..t...u`..t...u]..t...u]..t...u]..t...u`..t...u`..t...u`..t...u...uj..uf..t...uf..t...uf..t...uf..u...u...u...uf..t...uRich...u........................PE..L....p.[...........!.................X....... ............................................@A........................Pb..T....k..,....0..8...............`N..............T...........................0G..@............ .. ...Ha..`....................text............................... ..`.rdata...h... ...j..................@..@.data............n...r..............@....didat....... ......................@....rsrc...8....0......................@..@.reloc..............................@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ar-SA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	63048
Entropy (8bit):	6.588536490520649
Encrypted:	false
SSDEEP:	1536:0O9gSK8rih93rkkMy6HMyFPcIk9WvLdQWuB5X2PHJMK1SNahIg8DTuf3TV1EikMb:h9gSK8rih93rkkMy6HMyFPcIk9WvLdQw
MD5:	CD9C599823A276D142D9ACB18A8B801B
SHA1:	40B12D68A23FF1F31806D56D8A75E3C55A898C59
SHA-256:	6412C7FCB2836C0E059FFBA36FDF50882B61A5EC9FF23F780019A52E5C05779E
SHA-512:	10CDA635B5F975FACDA13D4480988A465775E6CE00DF0E4D34494D6943347A711B8922AFFD7D96F344A8CBB6FB3EA3A9B4E9E88F83F22C08C42008EB52DA4E5C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ...............................b....@.....................................S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......................P ..o...........................................k..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\bg-BG\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	66120
Entropy (8bit):	6.543326876591306
Encrypted:	false
SSDEEP:	1536:bO9nxMvE5lU94Zs+uNQGChcfaEt5tHBB8spapY1KCcLJIaSgN8AzlyGEikgUWsQ+:i9nxMs5lU94Zs+uNQGChcfaEt5tHBB8y
MD5:	D47B102DB26B2C40ADA0B88864D4BF16
SHA1:	5962E4ED89789D36A22130F10F5836EF9FD24358
SHA-256:	F0015E72C92B5B83FD23A62F8B0ADF25C53DA2005EB90BDD6ABE83BE4D91158B
SHA-512:	72E2F68460CF16EE211A81F50E63A12A61C5838D33D84D5A00C2F9DC44E6AD645A0DB01C22BC739436DD721A5BFE70D2B4E3227517CBFBB04B0C18E6669F444F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................... ............@.....................................O.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..............................................}..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ca-ES\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.459202313419593
Encrypted:	false
SSDEEP:	1536:6O9PKsQZAjb+f5g3GTGw9dLFqH78Iu3vwUT/aDXeX3iqeVQkiO7imJOEikSwsyCT:D9PKsQZAjb+f5g3GTGw9dLFqH78Iu3v7
MD5:	158930A69BD74A6476AA3817D1C2BEB1
SHA1:	2B9F0777B03832E92C50FCC58BD793C43CE60865
SHA-256:	E540D3BBDDAF741A9DDC6F0AB16E4C77115CE1F4B2D4C2037A00285012E0C003
SHA-512:	9ED62D6B361248E4AEE394F57488685F4E027D17F91F22C903668E713632CAB33A960B5B4E2F9717194ED1DF7B08816A662E344E04B12B6C81A1C44F61E776D4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................v....@.................................`...K.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..6...........................................2..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\cs-CZ\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60784
Entropy (8bit):	6.521074063197344
Encrypted:	false
SSDEEP:	1536:qO9CKHHlgdQ4L2QSW6YEcNHuSlMGtrVSL4rOeqDuseAT8HNQ30pEikrKsBCz9Z4q:z9CKHHlgdQ4L2QSW6YEcNHuSlMGtrVSs
MD5:	6169CF3B98276F3CF9974DC2D1CED2D0
SHA1:	2D9DCA45E40BF720D1ADB1D2A9F7F20E4F2EA931
SHA-256:	45287112403521B91DE985160177515004F2618D0DDD1EA0B3B9EBBC10BA5D62
SHA-512:	3CADAA8A166FF5527B8266BC88956319A88230C02E1F279A0805CD3EE39B0542C262EAF7E558AEB6750AF291AD4E3A4264D7F70B6AB4ED60E4D30EF4D739099A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ...................................@.....................................W.......................pM........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H.......................P ..k...........................................g..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\cy-GB\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.486964327280261
Encrypted:	false
SSDEEP:	1536:ZO9ADi+BGe+Yj+fEligSKm9qI32i3loAECsedjllekCRf4FwpL6pTgscpEik1HsF:k9ADi+BGe+Yj+fEligSKm9qI32i3loAI
MD5:	085E2A3801FD052FA78EB35784861A67
SHA1:	A08D98B2B03AD9EFC473CF9ED529039983D93D9A
SHA-256:	77D095EC973D379CB55A8B88EB3DB34F5FC02BBABE36DA6A25EBA3F2C382EF51
SHA-512:	E2AF53D5A6C61C52C0981C83BCCDA87939D64DECE4BF0D48CC1573C4E2D4D3773CA49A3174381BE1AA50D22CA4258229DD0C18C556519AD4A9A6FE457A2D0DD5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................zR....@....................................O.......................HN........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\da-DK\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59976
Entropy (8bit):	6.487146751316606
Encrypted:	false
SSDEEP:	1536:NO9Nhjxn9FWv4GByP5KpHSnLbM9B5vBmGOv0/kOeR/1OgBly2bCR4EikxRsxEp4i:Y9NhjV9FWv4GByP5KpHSnLbM9B5vBmGL
MD5:	97D41B502E4BEAE98B24AA3A4CAE529A
SHA1:	0926DBF0CEB2A3ADE1085FA4557038F574390C5E
SHA-256:	E33BE073C742689A49FD50F7AF08D1F013DD79C6AD918CE976447BAF84B7AF67
SHA-512:	C0A98F9472FA74E6FBBB5AC731F0D1F817B8B272B8E486F67FA23CABD7643D1C72B4901452FE257A7D9D6EDB2F3EB6A91D3AE2050B2CBF9B56FFCDEE0B92A1DA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................>.... ........... ..............................:.....@....................................K.......................HN........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......................P ...........................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\de-DE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62056
Entropy (8bit):	6.434087583320252
Encrypted:	false
SSDEEP:	1536:wO9P3k0b/0/IDJaXmsl/+ToOLWiXp3n4bydq5inL+yPocyx+q92nYHYHzB2iHG3e:d9P3k0b/0/IDJaXmsl/+ToOLWiXp3n4k
MD5:	F990C8CCBBA3F311BCB66CC36BD28090
SHA1:	D7EFAF9B2022B7EE0C794CB24AD2A8208C570630
SHA-256:	305A7A96FCE15405505331D6EF78DB5F88C4FBC32D5E9FE89EEB235DCA3335D9
SHA-512:	EE222DCB4DDFB650F18A3A7283AE8DE59FDC3A1E1A4DD58D80EC05C9934AEBD8DC9BAF9C1E77E3B1B5D66334CC7D823B6FBEBA57C6E17447AF8852DF454DC84F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................................@.....................................K.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\el-GR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	67168
Entropy (8bit):	6.566460710824405
Encrypted:	false
SSDEEP:	1536:ZO9OCfiY82Whhf/Oaxtz9dgqn1LsIOYCZx/QxJHDv+sBkzKJMPYBj8UHN7oEikcL:k9OCff82Whhf/Oaxtz9dgqn1LsIOYCZZ
MD5:	C38DB5F652DE91B18DCCBDFFDCCEC503
SHA1:	75BD4F252284E87BD4613913FC9B2D408AF355AC
SHA-256:	587A707E0596DD62135410B2922DF2BF4E28A44793366ECB9F80579C8761DBE3
SHA-512:	9C7D6775838672A45E98AC7C21679E3607EFEDD7EFB8673965279067AFBB65E88D39961D1309FD586B151049AB2C262361A3DD7E02FA45C7D73B5AE0207A11DD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................... ............@.....................................O.......................`N........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\en-GB\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.444190816855698
Encrypted:	false
SSDEEP:	1536:sO9jlXq39V7UTJazmvWyBmehkkSgwgt7pK1Iq6lDRyFxutpLdcIkey5JvEikr+si:Z9jlXq39V7UTJazmvWyBmehkkSgwgt7q
MD5:	0826E8C277C0DFE42735A448DB7940C7
SHA1:	8A7E1320F58A86745175B1D0301E822BFA04FB20
SHA-256:	1AA40D2BBA8F882BC44DF66B9BEA547A61012449DBFA404F3D32762BD728C865
SHA-512:	00728861F65405438F7C823A6CCBCA5B841D53F499B9B0B0856A9923B102E9EF36BBE1035AED809EDE3F2A40764F39811259C52A5A0287B9896C303F7805A11E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................>.... ........... ....................................@....................................O.......................`N........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......................P ............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\es-ES\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.471588224248052
Encrypted:	false
SSDEEP:	1536:vO9PcsKNcG6/SfNsIpERGRBPvJV50ATCaHC1B4/QYfsueQ5amCVBjEikgBs6d3zs:29PcsKNn6/SfNsIpERGRBPvJV50ATCa7
MD5:	601CA689F9075A86860FE17F6663A3E8
SHA1:	6DF7EE000E7CC0B7E81EAD584BF60F34783B7D50
SHA-256:	2D397D019C11FECE226947B075873BB1980FBC456BBFF743D92ABD9CD13AAC2D
SHA-512:	8231DC4D221D57A77159206D98AC874F920DB684862F22D43BE1DA0153B8CAF75B89C28BDA423FE9D1C3DF37EDA662426846963FBC7420D1AAAD162D59036ED9
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ...............................v....@.................................\|...O.......................`N........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..S...........................................O..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\es-MX\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.46459183752468
Encrypted:	false
SSDEEP:	1536:SO9PcsAbAUxcRLSpEebIfb5lG2vuq9o7UtIbQrZuGl2v/+/UAsOkjEikRVsgz4Zj:79PcsAbAUxcRLSpEebIfb5lG2vuq9sUE
MD5:	E74A7CD5447B6A0E49D077774C98E529
SHA1:	9A57894B831E59EC3BAE33673D3D384C6CEF2191
SHA-256:	E60CB451F0EEA3519C88D69EE4D4214FFBAFA07C6CE75DA722FCEB5090D3FD44
SHA-512:	131CB8A58C7B0C814A7AA1472E3CDBD3199BC5B6AABE5FD39AD8D78E00B395D9681089753F89E3194D709F55EE8FB6D13C9EFC3AC246A1CD1F7C8205D189989A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................3.....@.................................8...S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................p.......H.......`...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\et-EE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59976
Entropy (8bit):	6.484108194961219
Encrypted:	false
SSDEEP:	1536:oO9pDyWBFils6mKaFq1ZU7iPZn3VfrsYaInkpxOM8zrBwl0xvWbiLvkLEikkls02:19pDyWBFils6mKaFq1ZU7iPZn3VfrsYL
MD5:	D111BF070B29A4DB93EDBAB50B0A750A
SHA1:	94B22AF2C90254600869ACEBEF6BBC6172598834
SHA-256:	21E5E83D0ED84060CE883E628FF61E05B141179CF861B9CBE83C222816AAB6CE
SHA-512:	6319377FF841D97379FBA879B3F274A0270C010EE0A70CC624A9862D7F1B46E08ADD69A7DB00B6B62AE7FE670B459F5E956D67C33B67737937088F42F81AFE59
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................*.....@.....................................W.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..Z...........................................V..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fi-FI\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60512
Entropy (8bit):	6.482124743495525
Encrypted:	false
SSDEEP:	1536:mO9WHroG73/MBcBgbQtAIceIZJA4qErCGAqNDEvu/XcgKErjRfxLzqkPzEikp0sH:/9WHroG73/MBcBgbQtAIceIZJA4qErC5
MD5:	4191204671CF8F3D51B7C97034F7E8E1
SHA1:	B2CCD154E9679C5EDE4B61784F711F29E255DE65
SHA-256:	DE145030538AA124503DFAE7BAD0717A4515EA89E3E6F0F6BAECA72ABDCFA3EB
SHA-512:	046F578B6E95C8B5BD38D4D426E65AABDA7412011ED667E18E5B5EDC54BB1355CA5673600800F288C56216B54FD01865D1DC6CF64FF75FCFA4FE05882069BC93
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................h.....@.....................................K.......................`N........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..V...........................................R..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fr-CA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.470070999956776
Encrypted:	false
SSDEEP:	1536:NO9ADK9GGZoFZbcS0PFl8SJiJS4+X2uMd0dSBb/yNvd1SiUU/GpgYCv1Ny7qwEik:Y9ADK9GGZoFZbcS0PFl8SJiJS4+X2uM2
MD5:	604F05D82D7A9DEBE56EEC6330A8D56B
SHA1:	F606FD15D1BFE811996DE48C2B3CBB8C8819F58D
SHA-256:	5FB9012845120321AF415301EE387961F75C70BA87BC779725B7A66551219853
SHA-512:	3568A1982E827E507615863962D795AAD55CC049A1E98EC9734314B26E43F1BC82C2C8CB6D54BECE4D54427EB9D664881093D095359333C8B91AF6E37577194B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...................................@.....................................S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\fr-FR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.474432837189674
Encrypted:	false
SSDEEP:	1536:WO9ADl++Qh8hF3dLNbJZIeiVFbdQ9cBxIjfwjRGaDZng/7HXwpJjAvvhYpvvFi/p:v9ADl++Qh8hF3dLNbJZIeiVFbdQ9cBxS
MD5:	3D8EC5640C9A814D8D26483D135E698B
SHA1:	15FFB7ECFA9260FF2F0439727D67897240653BF1
SHA-256:	20040EB12C4BDE67FDABA345DD18F5D5A55EB1D4BD0E634CC589B7E2C66E6A52
SHA-512:	3E39AA837EF2FF7F698CEBF88BB775CB2245902FD8E4702970EE8535CD54D953FBEA5178C99DB0B938C62ED5850E9495F93590689A2A5EEFBCB933D8739545A6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................I.....@....................................W.......................HN........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\he-IL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62560
Entropy (8bit):	6.538819459136321
Encrypted:	false
SSDEEP:	1536:ZO9CElFACr31NvYOv0ffLE2WGNFzw9mgCOppcdIUX/a9BcPF4O9M6XXfEik2uIsV:k9CElFACr31NvYOv0ffLE2WGNFzw9mgV
MD5:	09BB3D444935C528B480C492832BA992
SHA1:	17E54297103F0E944C93F4162BE18AEDB8EA0779
SHA-256:	85D0797D32892617197026ED00BFE1BB2FE9A07CD64390410133D5C7F430EA15
SHA-512:	FA0C1593080AB8AE0723108742824B3574A713F12C25C310A3AAAA4C862D821B86B90F80AE94B1CCCBA3FB5976AA4DA7D43837B634AC3377E1CF80B4F75B2C96
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ....................................@.....................................O.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P ..q...........................................m..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\hr-HR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.469806225746028
Encrypted:	false
SSDEEP:	1536:ZO9dO2GxyJQPMKJUlRKXQu+aOdD68/8aEv8Fez74mwBxG211H/KqI+1EikdIsuzs:k9dO2GxyJQPMKJUlRKXQu+aOdD68/8aG
MD5:	80AFE9776BA5F8489BB61F385635B1CF
SHA1:	D518F36C5A4F00C5CA645F9BD21A79E0412E5974
SHA-256:	A63DE2AA929E57E502FCF8EE18F1875084E533AA8CDE337D69EFF020012057CE
SHA-512:	21EAC6874ABF12C7C182B35CB3C01178FC39F0C2E94BFAE4801A52F863C8A6D86E627F671A541B045A2C52154639A9D85014E142E18C776475020EB350D7558C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ....................................@.....................................S.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..^...........................................Z..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\hu-HU\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.516164435968868
Encrypted:	false
SSDEEP:	1536:JO9PebzfDSD12NfIBLCOP8mTtzDd0Wx4Ky6Vlm3KlbcGUYTo1f8Q8ZOQXOQ8M0Q0:U9PebzfDSD12NfIBLCOP8mTtzDd0Wx4N
MD5:	01A998681DAA1BFDFA695C533B8C2BB6
SHA1:	62D53791A965CEAAADEB8630E608A0D78667B2EC
SHA-256:	07FE7C4BFFC7713A0AB9DA12118512E9EE509EE14E603559B27E5DE346A53924
SHA-512:	B9AA272B473CED31DB1113B404263D054D5391D10C04453C2F48F6EA3BB36A81C1D8B5B1C67C43D13FFCA417AFD1825D0552E26DED0BB498E7A8FB76E674B51F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................~.... ........... ..............................?K....@.................................(...S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B................`.......H.......P...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\id-ID\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60000
Entropy (8bit):	6.46059690688784
Encrypted:	false
SSDEEP:	1536:sO9NagPURiGTqSzcnYzsdxAeetb2YHEKTtWA16o3vPjBjtLP7bscEikksms/pzdR:Z9NagPURiGTqSzcnYzsdxAeetb2YHEKm
MD5:	23273432D5E925CA8B9CCE0EB6C0786A
SHA1:	5FDB8A49D4E4ACBD4D549F10F5F2D276795B560C
SHA-256:	96214337ABEC104DB82EE954B39D3D60F8B2182D51F0DE6135A628BCE6BF6794
SHA-512:	E3F204D03B5AF109209EAF53F1FBB2057E50D2BC09A6790AF9459FD6104BD981BA79886D46E70D92BCACA1165C1776385391F9E0017E7F17025263E9A0D6C4A3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................^.... ........... ..............................g.....@.....................................W.......................`N........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................@.......H.......,...............P ...........................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\is-IS\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60512
Entropy (8bit):	6.501112106514937
Encrypted:	false
SSDEEP:	1536:bO9WAqYD97mcB1jaIJB8E3rTYSXxVG12uonduxkeU+BJRUJsQVr1i4EikrsYs5Lo:i9WAqa97mcB1jaIJBP3rTYSXxVG12uoI
MD5:	DF52D1A710E3DB3ACA1A79D7A9829F59
SHA1:	C10201F665058FA42A8BEBBCCF116125E8D1A1EA
SHA-256:	15BDA2260386923606A705541673483A76A545250D54EEE3BADE9F7949254906
SHA-512:	275F3DDD0A63C54BECBB14A7399ECDC7841929B43E6E192401590853EBDB8EFB78F495EFA27516CAC3BBDF0231F02BCA5F44EDDB6635F6FB9A079FC32E30FB8F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................P....@.................................D...W.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......l...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\it-IT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.438594682971094
Encrypted:	false
SSDEEP:	1536:QO9P3y5h0Fp0NK/gRcFvoZ4FKKC2msifHLrEvI2UzpCwqPZHas2dyHTWEikrPKsq:99P3y5h0Fp0NK/gRcFvoZ4sKC2msifH9
MD5:	EFF68E098E6B5AC2EC5DB86D59F2F34A
SHA1:	0F63B1FEED689CF723AA5D1F7D89FDCC68025D47
SHA-256:	74BC14FB2097D47F0EEC22DFB9429A86C511B3AE55EEA6D771F7E9C9697ED26A
SHA-512:	0F09D415684665994C1DCC9AA74C59D5F2D8ED183A6E703D53BDEF08CAF830129D5949C7B7EC2E000FFDB7DB8AB8CF624F896875372C6559BC7FE4E9EB35FCAA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................G....@.................................T...W.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......\|...............P ..+...........................................'..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ja-JP\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62536
Entropy (8bit):	6.6524750201589455
Encrypted:	false
SSDEEP:	1536:UO9WeuzR+bLcQmuGuRuBG6v7yM5uGJ0HIc2N37cRAoXDuII5ZCUaxvEikkTszIzQ:B9Weud+bLcQmuGuRuBG6v7yM5uGJ0HIv
MD5:	4D740F1B35367259CCF7C3452FA9409C
SHA1:	8BF81202ED93FCDDAA91386EBC7FD621B4177BFF
SHA-256:	66F6D9189B9E96F50105B34EE7C83B13929E1FFBB225F0A59B11F05E692526CB
SHA-512:	3B78B3C4A4367B2F75DC53EBFE9304B6DCBEC7EB50C06F7810EF2779B19F724A2B2BC10E56842E34277663010ADCB485EA955071A273ED11D187CA047B8790CA
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................>.... ........... ..............................{9....@....................................K.......................HN........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......................P ............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ko-KR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.646946212587404
Encrypted:	false
SSDEEP:	1536:wO9WAqhvGiu7WCbAfU8Uvg2LKhiM3fYzsKNLz89SghOD/4Ke5XLjEikwF2sfazmN:d9WAqhvGiu7WCbAfU8Uvg2LKhiM3fYzq
MD5:	26A4813F1569907D6E86B960B988746D
SHA1:	439E5CDC1F971D0D286E2C44801E4DDAB63A7C8C
SHA-256:	C66D0B47609CA2584649FB9EAE85BFEBDE348ABC6FCFF10BA9039735A1AFDCCF
SHA-512:	DBAE968A9A40850585867431169DB1620D9D224D7FF6A7E37F2AC50DF5C7BEAAD339355993EF4B4DAAC469118998ADDAFD485ECE5A66439738352932DA37B15B
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................^.... ........... ..............................p.....@.....................................S.......................HN........................................................... ............... ..H............text...d.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................@.......H.......0...............P ............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\lt-LT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.506165117406071
Encrypted:	false
SSDEEP:	1536:sO9B5vAqvshLrR3gUZO2A9oclmD1tdDnpRmtQH2QKDTLXosU2ex+nuY8ZEikgVQk:Z9B5vfvshLrR3gUZO2A9oclmD1tdDnpj
MD5:	3566373A90F09BA59EF4F7B1BA2A6FFD
SHA1:	FCBF1AC10A7191D471A2341845110E5572A204EC
SHA-256:	3365E80B1F4047773B510A5D0B6C0148DCB8D83F503F8F62833CE7BF8CBE9237
SHA-512:	0717C7855B2F66399FE367D58E971834122B8DFD5FFE6AA1D4FAB8F36C185A530D7B078BD420C6E54D93381521E15518FBB52C93BA5C38F0F29B94428EFC16B0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................]*....@....................................K.......................HN........................................................... ............... ..H............text...$.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\lv-LV\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.483761901779719
Encrypted:	false
SSDEEP:	1536:UO9jvyffWGiHpdYq84Ae89YJTrjz46UNhNnkGzColMa9TJERMCR+EikMnsCazydQ:B9jvyffWGiHpdYq84Ae89YJTrjz46UN8
MD5:	A71CFA89BB1AC26AE34B8D4815D6B8A6
SHA1:	B723CD73F03F7ED4D9366626525A69B868153016
SHA-256:	0D19FD402870D85278C10A70474A57DD1A4813656F13AFEDA006E04F4FFA6427
SHA-512:	EBD14080E66AD75CA1D4DCA6A792010C964950F6011B1B43DE9A50787AFA5898026A41DBE314409BB83D4F6F6F535AF7DA8181FA46B83861B14FE1186622E562
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................................@.....................................O.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\msvcp140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	447560
Entropy (8bit):	6.69362725487304
Encrypted:	false
SSDEEP:	12288:J08z9gRInEQpdGpPkKDyhAm5IiWDfg2n5hUgiW6QR7t5s03Ooc8dHkC2esv:J0CdEQpdG2KDy2m5IjDYA203Ooc8dHkN
MD5:	77FA8A6193B1830D2235F48987AEA5B5
SHA1:	0B2044D6738773FA174653BB818F4A1FE76FAC89
SHA-256:	C2B2103289B656617D85EF90C04A2B8F9CD7CAB1778E69563F884C89D892AB5E
SHA-512:	29333B6AB895440E5157F1895E180CAA4181D5DCB387CB626D4FA45CB3818AEA9658DE0C16FB72678425B7694DA39817ED6EF6B45425F57035A00B9070E97B69
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........ 2 .A\s.A\s.A\sr1]r.A\s.9.s.A\s.A]s^A\sO5]r.A\sO5Xr.A\sO5_r.A\sO5Yr.A\sO5\r.A\sO5.s.A\sO5^r.A\sRich.A\s........................PE..L...t%.`.........."!.........~...............0............................................@A........................`U......<c..........................HN.......6...W..8............................W..@............`..8............................text............................... ..`.data...L(...0......................@....idata.......`.......2..............@..@.rsrc................J..............@..@.reloc...6.......8...N..............@..B........................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nb-NO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60008
Entropy (8bit):	6.477288189346955
Encrypted:	false
SSDEEP:	1536:/O9NAXZqHGnAfUPOMnwjxNK0/84Z1aBBX2dulK0rEyKpFbFK0qA5/0EikMqsjz3X:G9NAXZqHGnAfUPOMnwjxNK0/84Z1aBB7
MD5:	0060BF986FE2F438507B2D8726406384
SHA1:	25996C7B6C49A8554413FEAEEB944ADCA570B936
SHA-256:	F376F3B31E296801504C86EA92AA1A593D611805311E7E7710770FACE1A77AEA
SHA-512:	90E4B18611FCF5DCC83B077938A43283AA82239EC27D269ABA481F119FC394298985DB5E13D5616EB0F3E418F592526E56230E39036465F524C0D8FA29F681C4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................b.....@.................................h...S.......................hN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..@...........................................<..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nl-NL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61024
Entropy (8bit):	6.460625681397577
Encrypted:	false
SSDEEP:	1536:fO9PR9q4u0ayE7tbVTGDyl5lr41AcUV3tbUe1FdFYWssYYzTRo+0W+zmtq6+D+rs:m9PR9q4u0ayE7tbVTGDyl5lr41AcUV3I
MD5:	37330ED5EA5EA01771D413C98FC32B7E
SHA1:	AA17C3B714F4550917A042F483054121B13B17A4
SHA-256:	C96FE685D8DD9A0BA9ED3B843FB69DC6722B179B765E028BE695AD1D8E06ED0C
SHA-512:	FA7DBC099A56690259C3B37E63A2C6A8D3543AB1058F27714D659FC3FAA827C1A960DC84CB2349CA6B24676FF3575AA61C8EA7D608FD5A5CD63024D6D74DF04D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................}.....@.................................P...K.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......x...............P ..&..........................................."..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\nn-NO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60008
Entropy (8bit):	6.484690147146799
Encrypted:	false
SSDEEP:	1536:LO9NlqiUFxfhZjVqvA/hIlCsOdLM0SB3b6RCJmwc3fF1p3Ruoh9lF7+TmuB/BYSs:S9NlqiUFxfhZjVqvA/hIlCsOdLM0SB3s
MD5:	BFA3524BA2302E078FC4BB315DFAEF36
SHA1:	5B1DE08A1DD25F1E8A227AEF0FDA478C6C2B3D2A
SHA-256:	9C27243B849F4AEAE152B08728731529314F03B32B5B447197914BB134E67A9D
SHA-512:	FF0DA53C5DA977AAA2FED565F3BFBEA44E0E8D14E101F9E9CE0E49747CBDC69CD53CDB1AF68A756D28424499A80FE576A2B3FFF5DFE962A48134AD9B69C6C9B7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................................@.....................................O.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pl-PL\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62048
Entropy (8bit):	6.499608570162744
Encrypted:	false
SSDEEP:	1536:lO9YM3z1nR8zMuKIJycvcygytrpu8hYGNNxYjEF9dmPTKgMsGRis0xEikBmsTC4y:w9YM3z1nazMuKIJycvcygytrpu8hYGNG
MD5:	46CA3125CEFAA641DCEEC37735E99857
SHA1:	7479ADEE6400FC727B99647E1393F0BDEDD76FE7
SHA-256:	E91C7D8291B548B0C87A8DBF5BA4AC48B070A71EE2624177F40B059A8E920ACD
SHA-512:	D6CBFEC4B65328162C295C85142676BD87B0EDCC27016FAF53ABE0391E5586244CE95CC8DC5E7BF35282DA6753B89E18702D5ED2ED654E3E566301A546F0C2C2
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ...................................@.....................................O.......................`N........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..b...........................................^..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pt-BR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.481733244293592
Encrypted:	false
SSDEEP:	1536:yO9PD+Ztk6ONWg3iynOs5U1jkFhKwKH/PIPq7tzZtq93YcZ8+gGxlEik6nsyzSZL:b9PD+Ztk6ONWg3iynOs5U1jkFhKwKH/P
MD5:	754393FD72CE7072C9D1CFB811BD6890
SHA1:	09C0FA677E62AE7B73C9227199D73E8E1D3781E9
SHA-256:	2104377F7A6D91954814982B2D01D8FB1387242348752B4D74F8DC51CDA3DCCE
SHA-512:	2D13331E6E3CEBE88F5904506E766AE914216846BD86437E0064027C79A228B1A825167AC85AD7CF9B0E2A3184483D54E04FD3F760849A5EE95490E535AF72F1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................L.....@.................................\|...O.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..Q...........................................M..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\pt-PT\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61032
Entropy (8bit):	6.4636076325119385
Encrypted:	false
SSDEEP:	1536:EO9P3hKCp6OYLZur7K/Wwtzx9RA8YGsBo4bUxOhTeiuQKYGasX2iBEikQqsnzJAS:x9P3hKCp6OYLZuXK/Wwtzx9RA8YGsBod
MD5:	5FF2A9B976FAA2D6D77DED84DABB4F23
SHA1:	BFEB0050B14BFC5B19387A5B97E33B75A3810921
SHA-256:	79E68866A498DCD35F2B6E7034E41DAE5C4C941B8DE68129D95E42A5F1635921
SHA-512:	3B40156578215F3E41D3D03D6ADE09C4E1171B9A13EA8A9A918BE8CABBBB1D537964A2715FB0A10A8F74D20D7D096DF0173CBA62EF849436057B6B17093727B6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................FK....@.................................t...W.......................hN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..K...........................................G..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ro-RO\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.491906435239392
Encrypted:	false
SSDEEP:	1536:uO9PchEfYkIl57Dr3w8Zw9XS+xd2XHsdlEhm5AtmxhG7TcFzCQOnIxEikTQsUpzx:H9PchEfYkIl57Dr3w8Zw9XS+xd2XHsdP
MD5:	210D110E8FD4556BB6D5BADD157FDFAC
SHA1:	BFB4682C6C53208F17D29DF7C893EAAC8B2FFC45
SHA-256:	CE1F0922E083915A2FD9F386ED239CAC7EB7BD22D5F3646C89EBB43C59EABA92
SHA-512:	B09F834515872D35EC304116AF38EAD505DD4FAC8CB8689E770EE11DB706D73A06DE59999D376078B5869BDB592A6450C0479F4F183134EA6E971937D28A685D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................................@.....................................K.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\ru-RU\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	65096
Entropy (8bit):	6.5757659638547805
Encrypted:	false
SSDEEP:	1536:7O9MFcYvxELwVgZIvKsk24cxu1XVwNCMRTid1j2rIgfdqI5TOfHtUw8EikGGUBsR:C9MFcYvxELwVgZIvKsk24cxu1XVwNCMi
MD5:	DAFF6FAD7BF7BCF89E924BCBB58CF945
SHA1:	D87DA98D42A22B1F4BFE3F67194B163FFB28BC01
SHA-256:	EE645F8D963A3143414F09C96149C39076B768B537A64EC0193D416B96A7147D
SHA-512:	C107F4616D81F83809CFA1B186E2303E958B0608EED4675153630312D8FF2826C28EF2075F072D7028149792B4CFA5E62261FD0C6971FD5B0E286BE88CA2F686
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................... ......_.....@.....................................O.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..a...........................................]..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\runtimes\win-x86\native\WebView2Loader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	120392
Entropy (8bit):	6.600820147251668
Encrypted:	false
SSDEEP:	3072:kkutiJKARK95EvS8BBwwgZqoc5+TiEt9XS3RMlyTI:kJti4WZBBdZEt9Syld
MD5:	D98053D49BFE481CBC394439879278BE
SHA1:	53DC39C37D780D5D5CB3D341C77A304919362BBC
SHA-256:	25D0F56DF1146C34F59D291B62E34608D2F7451D817EFFE5E94147CF182ECF41
SHA-512:	3CF06146E31574D3C13C13CB6D887C3D66C5E4C47E3291C2B4F3D7F196786668BF257702A8B6D9047BFC986784EF756ED9B1048CF3C9058C129588C19E3F61C2
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..L......a.........."!.................;....................................................@A........................M_......?`..(.......................HN..........D\.......................Y......`................a..<....]..`....................text...o........................... ..`.rdata...n.......p..................@..@.data........p.......`..............@....00cfg...............j..............@..@.tls.................l..............@....voltbl.H............n...................rsrc................p..............@..@.reloc...............v..............@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sk-SK\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61536
Entropy (8bit):	6.523136812660269
Encrypted:	false
SSDEEP:	1536:ZLO9gebhHq+ugsPXU6d/ic7SFgw0FAAgWwUT/8IS5RhOYPi5wt7D/TEikbss5zqJ:o9gebhHq+ugsPXU6d/ic7SFgw0FAAgW2
MD5:	E7991B70C6B77FEA9A62C4F8D7530431
SHA1:	CAE5F8E620566A0B88BEBB652CA05B6D488BD336
SHA-256:	9D57733FF03F65B3772E594C2B724516AAE07B36D278D95551ED0CF9C8E3FB0A
SHA-512:	1DFBC4E3D3DF1F096329CFAB20AF3DBE004914389723B72C0FD6C64524FCC0A62D00C9E1970E3AD4EFC5D290E1C3E3270835DC9DE833FF6DF42F8C935F75F1D7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ....................................@.................................t...W.......................`N........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..K...........................................G..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sl-SI\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61512
Entropy (8bit):	6.479386821033209
Encrypted:	false
SSDEEP:	1536:SO9mF2xWvZr5ttPBV5ramm5IgejsnMniPqhm+HFZUI8L0CmJ67V86o1n7EikSlIo:79mF2xWvZr5ttPBV5ramm5IgejsnMniu
MD5:	59B16C3C894BE415C7898631A56875B8
SHA1:	936B5488D3FA4A719DDB23E77349990F0B608B6C
SHA-256:	ECA7D7BEF9C766B58D52A9397950DFD255FD7CEEB6AD7F8A6FE40ADF8F4076C6
SHA-512:	3EEFD8BD4E3DBDE781211E21EE7D94ABC1B315DAB170AB6B7C54F50DD8F08423D89F3D31E72EAF55ECCD72F02B8C87CED43D6E0BA93EE9D5F737BB02BC2B009D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!.................... ........... ..............................Fm....@.....................................S.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..^...........................................Z..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sr-Latn-RS\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60480
Entropy (8bit):	6.4782272527779154
Encrypted:	false
SSDEEP:	1536:sO9ADvQ094ML8I+w2zbtseqNaio1KHc4hUyFE4RlxgCwXVn03mO0OHc0EikbLs7h:Z9ADvQ094ML8I+w2zbtseqNaio1KHc4N
MD5:	7A93FD8F03D33164125609576B16F7D3
SHA1:	4E9A26CC292F32C46E7AF980138459BB54FCB5FC
SHA-256:	7E77C6DB4E49369E22745AFD1902D43B69B63EE3904C98092325101E8E175425
SHA-512:	5A7120AE9518A7DC17378589770C65EBB2500F49ECD61810CFCBEB92598A3A1B0759416063CC323F45A7F9F8C62EA8A5C652D29C7D61124F54C9A99CD9AC227C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................>.... ........... .............................._T....@....................................K.......................@N........................................................... ............... ..H............text...D.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................ .......H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\sv-SE\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	60488
Entropy (8bit):	6.465184220792856
Encrypted:	false
SSDEEP:	1536:WO9NbIMAwsK92xi/p6ZCXczFy597Zh3ndpqW7A7MlN9XXW0LlTcE56fvEiknAs3E:v9NbIMAwsK92xi/p6ZCXczFy597Zh3n0
MD5:	EE967F32CA275BFD2ECCCC4E7DF8B2A8
SHA1:	ECABCA1D011A740F7BD4A70455BAC993ADE65558
SHA-256:	3752413BF675863D6907E3D28CEE268F21F23DA7D867B03316593A93AD9342E1
SHA-512:	4CAB44A67A27A5D6DF49DC2DFC90B6445E7B1C42E8C877B77B56850EEB5CF15467D14956F2E549CF34DC2E806040DE7D1653A1E73371CFCB131C51C29B1C8E4F
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...................................@....................................O.......................HN........................................................... ............... ..H............text...4.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\th-TH\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	70240
Entropy (8bit):	6.439305964283473
Encrypted:	false
SSDEEP:	1536:5O9f4A05v/3yGE0k4otwhknztUWCH34BsBrs+9XgaCTK6pO3/SNmKuREikFrsFaB:E9f4A0533yGE0k4otwhknztUWCH34Bse
MD5:	6427DDA9F993898603DE50DDE1528754
SHA1:	4737D69D4F8386C120DDA5A3718C31A7EB061453
SHA-256:	90951B5F5A58E50E3A1068FA9DD30D30F8257FC27D1586DC66EDC174559FE529
SHA-512:	B4925822276FDDED78553828384EA1A9016B49EAB38116FF0DC9748DA3DB1EEE5349C67586466BFAC29C8CDB1B10A4735ECD72E80A6AC427EFD834FC05B3623D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ....................... ............@.....................................O.......................`N........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\tr-TR\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	61000
Entropy (8bit):	6.505132466289463
Encrypted:	false
SSDEEP:	1536:lO9gSA64YW8K4MZQ00EOS4Lhq4YFfmKAZ2tWD5WtcRxzkebFbrLyXPEik6ms4pzd:w9gSA64YW8K4MZQ00EOS4Lhq4YFfmKAD
MD5:	E1C23198DA9715C0D8814AA42AD73F8E
SHA1:	CC56B69059EF89A9CE9507E9B71557C7FAF3EE86
SHA-256:	FC03EF162F1247354449D8B7CA9A0975A692E4C2571078BB00275EC40FB4DFF9
SHA-512:	5E4CB706ED60D7F20B5587D4D48F9634AA770BC6D482F380100B264C1ADDDA152D19E174DC1FFD7D1446A180DD805CDA4180C4FBC814C6D547606FE33FB2F870
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................q....@.....................................S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\uk-UA\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	64584
Entropy (8bit):	6.578204708909461
Encrypted:	false
SSDEEP:	1536:eO97noksNVY4yQM8s8KU9oTU9j6qImAdgM3XRPW+292RK/1BI3HkkKajWhEikvri:397noksNVY4yQM8s8KU9oTU9j6qImAd4
MD5:	A788D43CA80284DE4B1F4BE99260CFFF
SHA1:	3399A53E1D923C8FF17A7B1708CC80976F205CCF
SHA-256:	A54192AC15BB6BAD9BFD1E0A1A958A768A7D2D942E489B4246A0A8D6194E6287
SHA-512:	3ABB11B0623A93C9EB4C654B9C8D7DCD9DC2BAA5DAE4B14ED86212C4F9B710F76E438140A405498F2A4AB44748ABF113CE50282BBD0B0483FB80368822142BA4
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!................n.... ........... ....................... ......._....@................................. ...K.......................HN........................................................... ............... ..H............text...t.... ...................... ..`.rsrc...............................@..@.reloc..............................@..B................P.......H.......H...............P ............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	87112
Entropy (8bit):	6.939400200256647
Encrypted:	false
SSDEEP:	1536:0Ihq3RcCBwca4EZEXNciFk+ikPCpecbi/snazkZLzwN3A:0IY3RcCKcajodF4pecbi/78Aw
MD5:	BCAE3BAF0F089D495EBC8AEB278244CB
SHA1:	30E9D618650A9130743D44702B56D48EEFCDFC73
SHA-256:	6D6CD9AA3A3538F5C37A2BFDDCA9FC293AC3C05A4E708257BAFE2EB1AE49F1C6
SHA-512:	D76D22999BC7D79F4CC99FC3185CA074B8A3554412C5889BBD4497B1F2774761612791CBA4E58BCD97A38367AEB701ADCB0C5E249E0D3CFF005B19E78534AC49
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........\|R.\|...\|...\|..%....\|.......\|...\|...\|.......\|.......\|.......\|.......\|.......\|.......\|..Rich.\|..................PE..L...t%.`.........."!.........................................................@............@A......................................... ..................HN...0.......#..8............................#..@............................................text............................... ..`.data...............................@....idata..............................@..@.rsrc........ ......................@..@.reloc.......0......................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\vi-VN\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	62024
Entropy (8bit):	6.590924628799334
Encrypted:	false
SSDEEP:	1536:lO9gwu6Q6WwlEaDcQwi2kBPcJ5kGvxF825mb6ZB+D31jnVJvWf6Qjlux6mnEikSz:w9gwu6Q6WwlEaDcQwi2kBPcJ5kGvxF8b
MD5:	2C89412B5843494388D50CBC904074BD
SHA1:	41B85F801196AAA600B3B151CF9D92B837580BCE
SHA-256:	9874B9B27E20695019D48F72700D973258E89909D6606FCA6E72B2F51E9F62FB
SHA-512:	180AA2AFDBEAC3FFD6509B6AB3EC9D436AB07324D690A3AFF18E977BE9E3046FD8E07A06024976A425A00EC28C1373786E95A74EBB24FC41623851BE2C34C447
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................4.....@.................................H...S.......................HN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......p...............P .............................................................lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\zh-CN\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	58952
Entropy (8bit):	6.660184048742961
Encrypted:	false
SSDEEP:	1536:iO9WbWCHB/rkbEqBAVidKSlcZSI3+B0ncFytfjCqpXFBwW8jeFLt8EikfBsl3z++:L9WbWSB/rkbEqBAVidKSlcZSI3+B0ncB
MD5:	2143E5B5A9E66E73DC29FB4E455C7F29
SHA1:	0A92DA431F4C9AC788DBFD5E99F0CB2B0AA7EEA0
SHA-256:	7CD1B59BE13DA24CA6881FF41076C37DE6182D636E72CFBAD7BD4C5FCEFC77A1
SHA-512:	D98C74DF96125C5EDCFA1C06E127DF75584D7778C739728E10BB3C857503FA526FE6309D45749C3DDFBADD9EFFE472C57EF78ED05DCB8A554BFAA6A64BB01F0E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ..............................yy....@.................................d...W.......................HN........................................................... ............... ..H............text....... ...................... ..`.rsrc...............................@..@.reloc..............................@..B........................H.......................P ..9...........................................5..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\meeting-addin\1.0.24151.1\x86\zh-TW\Microsoft.Teams.MeetingAddin.resources.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	59496
Entropy (8bit):	6.636021348116236
Encrypted:	false
SSDEEP:	1536:yO9WbWqDTFAyR6j4hxW50IEdIhR2Ji1paNSh0CvJaCuXaSQCHM7IXzDEikhBsm8i:b9WbWqDTFAyR6j4hxW50IEdIhR2Ji1pv
MD5:	1F0BE9447A686B051BDB75E34F0C8EF4
SHA1:	ED8B0B02E54334211D1DAB4E3215EDA1C909F0B5
SHA-256:	C6D50C31D3AC401DD787B7C9711969988EB552F7633B3D243800380470DDC78D
SHA-512:	2A6E73DAF00542959B3BA61B07AF8B58EF3008ACE112D277CF479060961DB59708D7FF53B27CCCEB54A2BA682DEACB5152B7F0B97625847A93554D24B7A26C36
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....Xf...........!..................... ........... ...............................{....@.....................................W.......................hN........................................................... ............... ..H............text........ ...................... ..`.rsrc...............................@..@.reloc..............................@..B.......................H......................P ..\|...........................................x..............lSystem.Resources.ResourceReader, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089#System.Resources.RuntimeResourceSet............hSystem.Drawing.Bitmap, System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3aPADPAD"$......f.".g#.....y..?......J..;..........0z......q...gI........T.t...H2X..B...........g'.....<;..u.{.9...7.....'.V.

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\node_modules\azure-devops-node-api\ThirdPartyNotice.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with very long lines (1307), with CRLF line terminators
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	5.201982275359006
Encrypted:	false
SSDEEP:	768:OvEgPC779Lcs9Lu9L+y6zd9LT9Lt6lxUpdnqmPxtDvI+AL99La:OvEgPC779Lcs9Lu9L+y6zd9LT9Lt6lx6
MD5:	C97F02AB4F740BF448FE7F26E11A9C07
SHA1:	FC9B0894FEBAD42AF6E2C4C004FF09D069A7AC87
SHA-256:	18241A235903945E163BC9DAE8C5C98ADFAAEB8299A16A6BDCC07A9690DA6237
SHA-512:	380CD64F241E01FE2ACE06129A094C8B409B568081716596016D6D754BD4B31280FD712C66F975A158767BC02BB053EF8FB3848A67E186B61EB20A246D7D4F17
Malicious:	false
Preview:	..THIRD-PARTY SOFTWARE NOTICES AND INFORMATION..Do Not Translate or Localize....This Visual Studio Team Services extension (vsts-task-lib) is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Visual Studio Team Services extension. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.....1..@types/events (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..2..@types/glob (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..3..@types/minimatch (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..4..@types/node (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..5..@types/shelljs (ht

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\node_modules\typed-rest-client\ThirdPartyNotice.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with very long lines (580), with CRLF line terminators
Category:	dropped
Size (bytes):	74541
Entropy (8bit):	5.250992941278589
Encrypted:	false
SSDEEP:	1536:+NEYOPC4tF9FT9Lcs9LmC3f9L+y6zLliyAmMQ/oTjv9LexV59Lt6g4Ngx4Gv+Xvt:39R9z9J9iyXy+989x4Kx0E92
MD5:	68B616FD8348061E77780E52930B7605
SHA1:	333148FE8249F6B5EFAC2C5B10C29C85750428AF
SHA-256:	BB176225E4E1C521104A80952BC4E2D43FD1A400CD54619613D2243F944142BB
SHA-512:	EA96C1DEAC2718D59A3573482E6FD5C6637E962633EFF4110745EA22E9257FC7F0DD3F49D104A791E45D2B2F09DB5024210A04BD3E3288945BEBF67370AB64FE
Malicious:	false
Preview:	..THIRD-PARTY SOFTWARE NOTICES AND INFORMATION..Do Not Translate or Localize....This Visual Studio Team Services extension (vsts-task-lib) is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Visual Studio Team Services extension. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.....1..@types/glob (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..2..@types/minimatch (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..3..@types/mocha (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..4..@types/node (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..5..@types/shelljs (htt

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\tmp\Teams\resources\ThirdPartyNotice.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Unicode text, UTF-8 text, with very long lines (2046), with CRLF line terminators
Category:	dropped
Size (bytes):	428822
Entropy (8bit):	5.141739584920708
Encrypted:	false
SSDEEP:	12288:HjmBzNKKure0HkBfcFZW879xhX2myXNH+Z/W13p8:8hBm
MD5:	6ADF177E37C04AFEB5C507B0C0A05EBB
SHA1:	034C04E0868F37792B6786482316EEBF31B40C47
SHA-256:	C0A3D2EDBC9F8965C184633FED2CA1FEAFF25C93372F80A63C80AB2344DBD918
SHA-512:	A4F7BF9198A6327A90BA7027E2B41D1B10B48FA34C5857CD11B78BFF377C287669AC9DD933F25AA623405930714EEDD0033497C79DCF305A6F9D7888E2AB20FC
Malicious:	false
Preview:	THIRD PARTY SOFTWARE NOTICES AND INFORMATION..Do Not Translate or Localize....This software incorporates material from third parties. Microsoft makes certain..open source code available at http://3rdpartysource.microsoft.com, or you may..send a check or money order for US $5.00, including the product name, the open..source component name, and version number, to:....Source Code Compliance Team..Microsoft Corporation..One Microsoft Way..Redmond, WA 98052..USA....Notwithstanding any other terms, you may reverse engineer this software to the..extent required to debug changes to any libraries licensed under the GNU Lesser..General Public License.......(OpenType Sanitizer)..undefined <https://github.com/khaledhosny/ots.git>..Copyright (c) 2009-2017 The OTS Authors. All rights reserved.....Redistribution and use in source and binary forms, with or without..modification, are permitted provided that the following conditions are..met:.... * Redistributions of source code must retain the above

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\tmp\Teams\resources\node_modules\azure-devops-node-api\ThirdPartyNotice.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with very long lines (1307), with CRLF line terminators
Category:	dropped
Size (bytes):	41984
Entropy (8bit):	5.201982275359006
Encrypted:	false
SSDEEP:	768:OvEgPC779Lcs9Lu9L+y6zd9LT9Lt6lxUpdnqmPxtDvI+AL99La:OvEgPC779Lcs9Lu9L+y6zd9LT9Lt6lx6
MD5:	C97F02AB4F740BF448FE7F26E11A9C07
SHA1:	FC9B0894FEBAD42AF6E2C4C004FF09D069A7AC87
SHA-256:	18241A235903945E163BC9DAE8C5C98ADFAAEB8299A16A6BDCC07A9690DA6237
SHA-512:	380CD64F241E01FE2ACE06129A094C8B409B568081716596016D6D754BD4B31280FD712C66F975A158767BC02BB053EF8FB3848A67E186B61EB20A246D7D4F17
Malicious:	false
Preview:	..THIRD-PARTY SOFTWARE NOTICES AND INFORMATION..Do Not Translate or Localize....This Visual Studio Team Services extension (vsts-task-lib) is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Visual Studio Team Services extension. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.....1..@types/events (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..2..@types/glob (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..3..@types/minimatch (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..4..@types/node (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..5..@types/shelljs (ht

C:\Users\user\AppData\Local\Microsoft\Teams\current\resources\tmp\Teams\resources\node_modules\typed-rest-client\ThirdPartyNotice.txt

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with very long lines (580), with CRLF line terminators
Category:	dropped
Size (bytes):	74541
Entropy (8bit):	5.250992941278589
Encrypted:	false
SSDEEP:	1536:+NEYOPC4tF9FT9Lcs9LmC3f9L+y6zLliyAmMQ/oTjv9LexV59Lt6g4Ngx4Gv+Xvt:39R9z9J9iyXy+989x4Kx0E92
MD5:	68B616FD8348061E77780E52930B7605
SHA1:	333148FE8249F6B5EFAC2C5B10C29C85750428AF
SHA-256:	BB176225E4E1C521104A80952BC4E2D43FD1A400CD54619613D2243F944142BB
SHA-512:	EA96C1DEAC2718D59A3573482E6FD5C6637E962633EFF4110745EA22E9257FC7F0DD3F49D104A791E45D2B2F09DB5024210A04BD3E3288945BEBF67370AB64FE
Malicious:	false
Preview:	..THIRD-PARTY SOFTWARE NOTICES AND INFORMATION..Do Not Translate or Localize....This Visual Studio Team Services extension (vsts-task-lib) is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Visual Studio Team Services extension. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.....1..@types/glob (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..2..@types/minimatch (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..3..@types/mocha (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..4..@types/node (https://www.github.com/DefinitelyTyped/DefinitelyTyped.git)..5..@types/shelljs (htt

C:\Users\user\AppData\Local\Microsoft\Teams\current\snapshot_blob.bin

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	407384
Entropy (8bit):	3.333475459817519
Encrypted:	false
SSDEEP:	3072:O/ycCzaMpI95BLgxJV4lW1OJY66c9xYtY/Pf:O6xar5Jq1O7Ku/X
MD5:	9E9DD5228E99AD6CC47CF6A2520FAAD0
SHA1:	084008A5441E576457749C48B97C542E75FF82A9
SHA-256:	02C1D3ABBDA8F7E5FAAA02555F9B20D34E3B5DCBC81E3F450C0EF532F5407BBF
SHA-512:	FB66406C29FD2A7C76E190239757909C784992EBE0F2C1905B1EB7C485CBA4C23BDEA58E3270B8206309BB2B748BBE4D528570042E87E67CCF0FAECD2A72F96B
Malicious:	false
Preview:	..........).10.2.154.26-electron.0..............................................Xu..8...b...H...a........a........a........at.......a........a.......... ......`H...D..W.M...W.....W...D. ....`H...D..W.=...W.....W...D. ..`H...D..W.M...W.....W...D. ....`H...D..W.M...W.....W...D. ..9.`....D..W.A...W.....W...D. ..i.`H...D..W.M...W.....W...D. ....`H...D..W.M...W.!...W.!.D. ..`H...D..W.M...W.%...W.%.D. ..`H...D..W.M...W.)...W.).D. ....`H...D..W.E...W.-...W.-.D. ..`H...D..W.M...W.1...W.1.D. ..`H...D..W.M...W.5...W.5.D. ..`H...D..W.M...W.9...W.9.D.(Jb....A.....@..F^.....U`....`.....(Jb....E.....@..F^...`.....D.9.IDa........D`....D`....D`.......`.....D].......D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L`.....HD...%.D...L...........................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\ucrtbase.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1022560
Entropy (8bit):	6.657712265319648
Encrypted:	false
SSDEEP:	24576:YOPJ1g7mT6BNvwTOxNfoYotrz1111111r8SoKxmxvSZX0ypdNLhR6:YO1aNoaxNfo/+ao
MD5:	1D84140F287B0AF40150FD4B487A5CE7
SHA1:	51798B86B47341FE99E840477F0894372D06ABD2
SHA-256:	841FA4499144C3C94C1696F9446974C5BA780ED027EC259BBF006FB259E2C571
SHA-512:	5CCBE7E5AB0F1CD69341B288D52ED301B66D85DD2C16E58338A8ED8AF7D0B1D36128450A27AE3B44B6B49DEAF3AB7811DB80B53CC5D408D74BB3CC63E0556A3C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......Qp...............ib.&...........Ny......Ny......Ny..$...Ny..H...Ny..-...Ny..^...Ny......Ny......Rich............PE..d.....\.........." .........F.......6..............................................(C....`A........................................p.......d........................L..`N...........i..T............................2..............h`...............................text............................... ..`.rdata...t... ...v..................@..@.data....$...........\|..............@....pdata..............................@..@.rsrc................<..............@..@.reloc...............@..............@..B................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\v8_context_snapshot.bin

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	data
Category:	dropped
Size (bytes):	730800
Entropy (8bit):	4.678174904396932
Encrypted:	false
SSDEEP:	6144:N3cjYbWpwVjYj10yoTYZrmYdQyKeTRj9LigEkVMXsmTDZbt5X4bn:0YnYjXF5/9CsmTZt5XWn
MD5:	067B049CF02325F2BA017887051BEE31
SHA1:	AFC4FD114D6A34891FB23F043AA99AFAC6DD8E63
SHA-256:	B604041F85FB693F130BF0AE60CE83EBFCA56371CEC261085620E56AE93AB591
SHA-512:	F9948E9F65BA6D86AE4FE6EC407FB393A05CB28C100A7638127572AB1C18BE2B4333F619472C3A19EB19337739C10A79BA04325A555442AB35CFF0B6E8847904
Malicious:	false
Preview:	........).3.10.2.154.26-electron.0..........................................x...(....P..@.......b.......a........a........aR.......at.......a........a.......... ......`H...D..W.M...W.....W...D. ....`H...D..W.=...W.....W...D. ..`H...D..W.M...W.....W...D. ....`H...D..W.M...W.....W...D. ..9.`....D..W.A...W.....W...D. ..i.`H...D..W.M...W.....W...D. ....`H...D..W.M...W.!...W.!.D. ..`H...D..W.M...W.%...W.%.D. ..`H...D..W.M...W.)...W.).D. ....`H...D..W.E...W.-...W.-.D. ..`H...D..W.M...W.1...W.1.D. ..`H...D..W.M...W.5...W.5.D. ..`H...D..W.M...W.9...W.9.D.(Jb....A.....@..F^.....U`....`.....(Jb....E.....@..F^...`.....D.9.IDa........D`....D`....D`.......`.....D].......D`.......VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa...........VIa............L`.....HD...%.D...L...................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\vccorlib140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	344648
Entropy (8bit):	6.03471108045702
Encrypted:	false
SSDEEP:	6144:OaGpFE+VAtdoFb6/FrlBu+MbNNSUgzCZXdbQ2P:Oaf+VHFe/dlBqKUfQ2P
MD5:	B50AC3B8BC02A3667BB946BB4BDD454C
SHA1:	960713D139716B9DCF7CA84772F403566485ABC0
SHA-256:	0B526C2204B0B965B68C32F5E27E05DF6EB711D42406745CFFE461EF4F0EDD06
SHA-512:	40F3A08A3FE02F6E0F7599E8DD0ED5321C093B9BE114D4C271F5D7F87F2AF0EF475ED0B5C200BC4F2BBEA3C9F309865FD7508DA869E9604F99EEAC00D6EE03CE
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........)...H..H..H..0\|.H...2..H...2..H...2..H...2..H..I:..H..H...H...2..H...2..H...2..H...2..H..Rich.H..................PE..d...I9............" ... .....p......P{.......................................0............`A.............................................>......,................ ......HN..............p...............................@............................................text...6~.......................... ..`.rdata..n...........................@..@.data........ ......................@....pdata... ......."..................@..@.rsrc...............................@..@.reloc..............................@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\vcomp140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	191552
Entropy (8bit):	6.458687634266454
Encrypted:	false
SSDEEP:	3072:wBFccDm4XHgWExRgn+PywAjWxxIvU9e1IOdP0tTLuoQzmxadCp3S:OCR4XHmxRgtjAa8wfW62aWi
MD5:	4678590F6D931EB7FFFCDA1416BF9E08
SHA1:	A7249DA03AEEF44275EED224978A6B9FAE390E1C
SHA-256:	B6B0BD3017F3460494DE7E4DCF7FD4F4A6556ADFA87DE84566753CA2BB124541
SHA-512:	83B1F105D19B22FE7DCCEE4DC3C4C8602F3C7554A5113EEE7F32455A1164D560FBD4EA30124629C5105E657FE173B49C6B82290E426876B76A73C63C86CA6449
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L9...X...X...X......X.....sX......X..h"...X..h"...X......X...X..gX..h"...X..h"...X..h"...X..h"2..X..h"...X..Rich.X..................PE..d......-.........." ... ............@h....................................................`A........................................._.......l..(.......................@N......0....B..p............................A..@............................................text...u........................... ..`.rdata..<...........................@..@.data....%...........`..............@....pdata...............l..............@..@_RDATA..\...........................@..@.rsrc...............................@..@.reloc..0...........................@..B................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\vcruntime140.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	108616
Entropy (8bit):	6.640229553645366
Encrypted:	false
SSDEEP:	1536:CxhUQePlHhR46rXHHGI+mAAD4AeDuXMycecb8ifVpzOZaze:Cvk4wHH+mZD4ADAecb8YVpLS
MD5:	9604E07A7F80BE45D8CBADF3238A9FFC
SHA1:	14ACF199A7E3F9334E319C9CB0FD6C02CE1FCF54
SHA-256:	210BA41F4AE7808DBFF12ED601889FCBB345D173DA48762B3D115D19E1C855C4
SHA-512:	6DD9893250CD12B4E04A3386D9E38C05373D7ED8DC8D59F08BCFAA7B62FB7CE8619F84D248DAD899891E1B1F82103215ABC0698A5C0BFE9AE3652E374B9F8A08
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......A.&k..H8..H8..H8.I9..H8...8..H8..I8(.H8e.K9..H8e.L9..H8e.M9..H8e.H9..H8e..8..H8e.J9..H8Rich..H8................PE..d....9............" ... .....Z......`.....................................................`A........................................0C..4...dK...............p..p....Z..HN...........-..p............................,..@............................................text............................... ..`.rdata...A.......B..................@..@.data...0....`.......B..............@....pdata..p....p.......F..............@..@_RDATA..\............R..............@..@.rsrc................T..............@..@.reloc...............X..............@..B........................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\vcruntime140_1.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	48200
Entropy (8bit):	6.729562994683191
Encrypted:	false
SSDEEP:	768:ohh4pTUUtmUwqiu8oSRjez6SD7wZ9zdgElK9zJAf:QJ9x70w7zdZ2zqf
MD5:	0C2E22E8722268B739223C7CE150AB6C
SHA1:	F894E5B3805E3E81801148CA1EA5ED3D3C5732B8
SHA-256:	0AEFC52571581B4C9CAF809D376B950EB311F6E8E288F60DC48F07FC1EFBAE8C
SHA-512:	D0EEDB68AF484683828B5C26A27250D191B0898DE36D519E65C42E0657BD82AF820071D0D616A98EAAF003DCE3891F4FB11E84C6CF5FE2E110190468E24830FD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L......................h.........G.........:...h.......h.......h.......h.......h.+.....h.......Rich............................PE..d................." ... .:...0.......A..............................................i(....`A.........................................m.......m..x....................n..HN......D....c..p...........................`b..@............P..`............................text....9.......:.................. ..`.rdata..."...P...$...>..............@..@.data................b..............@....pdata...............d..............@..@.rsrc................h..............@..@.reloc..D............l..............@..B................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\vk_swiftshader.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	4779616
Entropy (8bit):	6.28594493886557
Encrypted:	false
SSDEEP:	49152:rUEEwQrTMh3bo/PxQgtn0IK6W3NIIYl4R/3S+w8CjTiMH7vPF/14ZLGpS7rlykMz:Vy/5kd67MI9NBd
MD5:	DCF41A64F238C3DAD53C96C30A6B78DF
SHA1:	D776B30B040A6F684D35E41E2CAD66C17BE66B15
SHA-256:	C1AEF81F1720FE7D51CDC082AF27888072DFAEFE79CB54191B092D418F3DC6C6
SHA-512:	3C4F7E41A99AA4EBA2C56C05292AECB3A4AC4592B3015A8BB02CB2B2D2A1F7E0467DC851503C83E3AA83D4089746C40E377DEFFB8DD2277C5E66DB80A59ADC76
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......c.........." .....N;..J......@M4......................................0J.....{.I...`A.........................................E.......E.P.....I.......G.h3....H.`N....I.$i....E.......................E.(...Pa;.8.............E.X............................text...RL;......N;................. ..`.rdata...L...`;..N...R;.............@..@.data....7....F..&....F.............@....pdata..h3....G..4....F.............@..@.00cfg..(....0I.......G.............@..@.gxfg.......@I..,....G.............@..@.retplne\....pI......(H..................tls....A.....I......H.............@....voltbl.8.....I......,H................._RDATA........I.......H.............@..@.rsrc.........I......0H.............@..@.reloc..$i....I..j...6H.............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\current\vk_swiftshader_icd.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	106
Entropy (8bit):	4.724752649036734
Encrypted:	false
SSDEEP:	3:YD96WyV18tzsmyXLVi1rTVWSCwW2TJHzeZ18rY:Y8WyV18tAZLVmCwXFiZ18rY
MD5:	8642DD3A87E2DE6E991FAE08458E302B
SHA1:	9C06735C31CEC00600FD763A92F8112D085BD12A
SHA-256:	32D83FF113FEF532A9F97E0D2831F8656628AB1C99E9060F0332B1532839AFD9
SHA-512:	F5D37D1B45B006161E4CEFEEBBA1E33AF879A3A51D16EE3FF8C3968C0C36BBAFAE379BF9124C13310B77774C9CBB4FA53114E83F5B48B5314132736E5BB4496F
Malicious:	false
Preview:	{"file_format_version": "1.0.0", "ICD": {"library_path": ".\\vk_swiftshader.dll", "api_version": "1.0.5"}}

C:\Users\user\AppData\Local\Microsoft\Teams\current\vulkan-1.dll

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	895048
Entropy (8bit):	6.592707960432529
Encrypted:	false
SSDEEP:	12288:HPcsZ/i18O9zheQQZ7bjnfjaimmVBmJUAI0/bf1IohDX6G65:HPcL19F0QCn5VBKQmSgW
MD5:	59609D418A0F3B0ECAD12AE3E4CDD103
SHA1:	E0CC2B9F9BB2B9ADF837F268AEFEDF4E48496718
SHA-256:	829B0595D3904EB6C6D32588AC6237749F38429A22155BDCF751D6707140CCD2
SHA-512:	E045A66B096B8FBA1079192788EC13938B3ECD80244F888546C3C4B6C4E02555B74D88C3031B56BE0C82B6E8A37CC0EBE75685744FB2DC0F191C70119EF5B478
Malicious:	false
Preview:	MZx.....................@...................................x...........!..L.!This program cannot be run in DOS mode.$..PE..d......c.........." .........B......................................................=W....`A........................................0...@!..p...P...............Pg...Z..HN......<........................... ...(...P!..8............................................text............................... ..`.rdata..\x... ...z..................@..@.data....L....... ..................@....pdata..Pg.......h..................@..@.00cfg..(....`......................@..@.gxfg...`'...p...(..................@..@.retplne\............@...................tls.................B..............@....voltbl.8............D.................._RDATA...............F..............@..@.rsrc................H..............@..@.reloc..<............L..............@..B........................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Teams\packages\RELEASES

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.769794932794191
Encrypted:	false
SSDEEP:	3:b2yLL8sXimxUoS/0FTADGLrGObn:pLL8sSRoS0vGObn
MD5:	CE12FC52AB8D6B441448BE2479B2C26B
SHA1:	521F0A48E7DCAB9E9FDF7DB9C0C66E51E4411124
SHA-256:	7AC6BF7F5058227F9C23A1771BEA7A9CFDC995312AA6952D45C15132FC72483C
SHA-512:	2F9E25C4AF5CD9E4661DC7185B24B42AADABB21698BC0B98B95F8FAC51A770E52B9D2B07BFF38A35F564E6172177D4E182A7F1EE7B89E030B288BE8D50F7E593
Malicious:	false
Preview:	.3232F40A817D02FCCC6BE97296C5AF94AD7A1F9A Teams-1.7.00.15969-full.nupkg 143249635

C:\Users\user\AppData\Local\Microsoft\Teams\packages\RELEASES.exe

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	26208
Entropy (8bit):	7.105578621101084
Encrypted:	false
SSDEEP:	384:YD8XDbCstLEpcR9z0K0Zo/NEHRN7XtG2R9zyvU6NrgP:DTPLEpw9zz0qAX8K9z9argP
MD5:	6BB9D2EC6EA3BC899060AC1EBA3FBE62
SHA1:	4021108420F61F94FB6F3C7C6A72285165707E03
SHA-256:	F1AE951A1A481377E866C844484AC08D7F34280CF48DE94E317B21F879F4355D
SHA-512:	CD67217B781E9DEE946BD94774C3277A5096F97BDA3874B096A8271F6489EE750B8BBB863738EA526C627CF0CAEB0E5CE16E6576031346840DB7316084340DD6
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...~..e.........."...0.............F&... ...@....@.. ..............................1.....`..................................%..O....@..D...............`N...`.......$............................................... ............... ..H............text...L.... ...................... ..`.rsrc...D....@......................@..@.reloc.......`......................@..B................(&......H.......\ ..`...............................................................(.....BSJB............v4.0.30319......l...T...#~..........#Strings....l.......#US.p.......#GUID...........#Blob...........G..........3....................................................}.U.....U...5.B...................I.*.....u...d...............................).....P ......%.....S ......<.............<.....<.....<...).<...1.<...9.<...A.<...I.<...Q.<.......$.....-.....L...#.U...+.a...3.....;...

C:\Users\user\AppData\Local\Microsoft\Teams\packages\SquirrelTemp\tempa

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with no line terminators
Category:	dropped
Size (bytes):	83
Entropy (8bit):	4.769794932794191
Encrypted:	false
SSDEEP:	3:b2yLL8sXimxUoS/0FTADGLrGObn:pLL8sSRoS0vGObn
MD5:	CE12FC52AB8D6B441448BE2479B2C26B
SHA1:	521F0A48E7DCAB9E9FDF7DB9C0C66E51E4411124
SHA-256:	7AC6BF7F5058227F9C23A1771BEA7A9CFDC995312AA6952D45C15132FC72483C
SHA-512:	2F9E25C4AF5CD9E4661DC7185B24B42AADABB21698BC0B98B95F8FAC51A770E52B9D2B07BFF38A35F564E6172177D4E182A7F1EE7B89E030B288BE8D50F7E593
Malicious:	false
Preview:	.3232F40A817D02FCCC6BE97296C5AF94AD7A1F9A Teams-1.7.00.15969-full.nupkg 143249635

C:\Users\user\AppData\Local\Microsoft\Teams\packages\Teams-1.7.00.15969-full.nupkg

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	143249635
Entropy (8bit):	7.997720883346693
Encrypted:	true
SSDEEP:	3145728:UPfX4U6yCCMje92AEdGaY3EvFv8y9F0BzrOeFYvFj:UPwU6yCCM9D40vFvvaBzLgFj
MD5:	7DDB6028895226742967DDBE9471D569
SHA1:	3232F40A817D02FCCC6BE97296C5AF94AD7A1F9A
SHA-256:	9AB0AFB201BFD1E701B07AA287A39CA83E6A18D64DDD16664802001FDE3EAB94
SHA-512:	8FB027AB14F17415B72D68EBE35E07CD7DD3EF986056899B252DDA6B70980A4E333BF3E90755A9735DE03A6CFD68808C1109CCADEA81F9A116F5B70333C73D28
Malicious:	false
Preview:	PK...........X..\.............Teams.nuspecuQ.N.0..#..U..-.LCY&..np.".m#.....I.t.e...=..Y.O.P.Rd....UU.....,~...z........hY..c...0..\|..U]A....P..)...#.m..s.j.O.#kH...&L.6..T..}.jX..$N.Z.."#.(}.l>.o.[.S.V.\..gv..t....,....3..s..h.Jf....B.:$.I........L.0.........p..F.^%....i.......z.WD..z$..I.M<..b.n..Ym..[.....@:...?PK...........X....6...........[Content_Types].xml...N.0...H.C.+.28 ....../.%N.H.(v..q..x...$.......c....l........;y.ZK..$.c..\s'.....-.......Q.W.....U....2j......A...H...%...h...).x...(^ ...G.E..:....jW.hO....U%.>8..W.A...L.0.9#.......+.....h)..~...f..3/y.XxL.8..w........{.X..;...)r..F.g....fM>...8Z... M*..R..<..".w.u..........r.K...U._i..PK...........X...X./..H\..,...lib/net45/api-ms-win-core-console-l1-1-0.dll.\|.TT....0.(..$K......s.A$.9.CF.(..%..$.J.J..EP...HFP..D..............^O.]]]].ouW...........a{......!.~..@v...RM...&T.!..........e..jg...f.E..\|=X.=X.t.Y.=.B..D._x..&n-SE^..k..K.;.6.n...].m;.....t.'..2.b......u..[.......w.D{.)v....

C:\Users\user\AppData\Local\Microsoft\Teams\setup.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.063335204640661
Encrypted:	false
SSDEEP:	3:Y1AohbpTZJ4n:Y151pr4n
MD5:	F57CCF6F5B9C1E2AAC3C144605B53AA5
SHA1:	97B96FB910D992E53C305CA7D93CBC396567B0F8
SHA-256:	A92CCAA545B4AF7A81AC10C260291C3C33FB68197D150F8A42D1FBF74EB27648
SHA-512:	D7959CDEFF648169F967F4F09771C1D6466929C8120D31064570CAB88F83D14041A4CC56F09019799770189F55CCAE89AAD18BF40AC788A717CB1ADE1F52F957
Malicious:	false
Preview:	{"--exeName":"MSTeamsSetup_c_l_.exe"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\53IVYM2Y\kc[1].zip

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1372291
Entropy (8bit):	7.99657735391603
Encrypted:	true
SSDEEP:	24576:KlGhf2w5QPC2X3IoYQhZd4E7ZQjAeWajCd8BfESNnBW/wY+3w/WhGqQFqNdjp2Vh:Ko2wryYE54IgBWACd8NNnBW/wY+3w/WU
MD5:	EC5417308B4F15D20CC50BC1FFB0A4C2
SHA1:	0D4A66F6EFBB600A4613ABB136E2187E3C56EE6C
SHA-256:	EAE19BEE545EC136BC707F7B4113B33DF96CE52E36059FC394797D7169DF9634
SHA-512:	A1FD6D519B2557833713FE42BB5F0C1AA1A68B59B1697260A1A87A7AE0CAFE4BC70A9B5E7BA6A9E072A11397AF083F8CFFF3475D5CA9C325BE38653F6C8F4EBF
Malicious:	false
Preview:	PK...........O.m./...........KBDBASH.DLL.Y{lS..?_.m..!).,]..1...8o.(.;.yBBpy.8...<..I..mS.R.j(..i..0..M...JK...?.-..)S.B.ga..Q).e.{.c..i.6....s~....;..wn...A:.H\|....@.2.t..w.#.V.....N..ws.\|..2......J.{` 0.tz......P..[....k..\i.>.........X.}y.x?s?...4. \|...S..mn-.......5g.....\|!m..HC..T9....]F.JXz..5#......r.Km..f..b.hK...........+...!..#C.rym`._..y.Cn........eS,..C...5...e.lAo_.K[.....{.?........F......e[..g.q..jX.Z.l..3.G..+W...... ..(e.`^..y..B..........py!.......])s........2/`..<..._9..W....4...q1[...c.z...../...U...7.. ._......g.....2.Q...u:.~.._.E.j.8.^.M0....i.v..0.\|..3.m.\l.E.\h.;.....\...6...EZ.n...P.kB....EU....A.U.?^S...!..%..A.....I.+hw/<.4....n.}.J.Br?.;...J...A...#v...>.:*..A.-......!....M...>........~9...:~....8............O....8.~:.5B. .vw....^..mX......[.&;.>.R.=..C.d......O.....=..O..=.....^.CO.C....ez.....\|Q...4....Q...G....X.....".~$..}a....\.vxC.CL.A@..v.K..,...D..z.(.a.h.....b?....!Z.&...q...cpL..........."..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\kb[1].zip

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	19724
Entropy (8bit):	7.961727072979115
Encrypted:	false
SSDEEP:	384:jfAWNDQKN6IStsGnBwZq4iwAEEiXMamoU/JiLtG8F/S1eAMKGwI:jfBVQKN6I+Bw0cXMlDB4b/S15GwI
MD5:	03A490BDD1140B08C2EF80E023F1ECED
SHA1:	2D7D334D7092EA1C0576A59825FC70B1F01D4FFD
SHA-256:	849FEEA61CA27ECD7B1951AB7C7B3D68F7A4A0D20A844B7CBC15BE473E68FDD0
SHA-512:	1CAC94F1C5A1FA54E12005B1D5DA8BAFBEB4665571D8E6A8DFC64804021E0CBDD91AC1A581690885C18D762FA8AFEEEB735961D9B287BCCA5AC5BACE40782491
Malicious:	false
Preview:	PK...........O..Gk}...........KBDA2.DLL.YklT...f.........P.....z.d.$]?.k..&..Q.....gv..!@.@.?R.%.a.....x..mi..>$.j$.?..&B.S......>.s.].^.F.".R9..g..3.3gf......@.}...S......Vn...7...?%...?........O........A5<.......o .t..pp.I...{.}......J..<...e..H.........}@.b.v.q..is.....\|...yi..wT.q._..OR.>I......K.Pv!...uQ_$J..,,.&}...!\|t.........Wit....O.K.z.V....{].H..\.1..Er..p.w......].X...c._....e.V.?.C.. .C.{.M:7H...[3.;u..!.E.m.:..,.....rO`P......\|..2..K..3/b^(.>.#..%...1/d..r..{..b^..y..b.E...k.....]=.?:d."..b...e5.......A...5.K..x<..0./.X..#...f.\|..Gi.UR^.j4..!t.;U..r.........L.m..&\d.&...L..KLx...6a...b.Dc.F$5#-4.~...I~[.......f.......e.F5....C.......-x..U.. .JkO.g...u.V!...._X?5.S.\|X.T..;e<s\|.qTR...,j.B.N.".y'<H.(.O5..T?...PNoF]..L..&.......l..5S.U.FH.Um..=.T.R.....oC./..I............ i.I....n.PJ... ...2g.;.R.V..a..(c.P.d....I.ZQ......9..Y\|Q.e....(.Ue..o.....j..,,I......rT.y...b..FF+......P..*.......Y.I......O.+.P.J.x...2....[9.h.ux...;.x..Z.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9C680Q69\msteams[1].zip

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	1143077
Entropy (8bit):	7.997879693465254
Encrypted:	true
SSDEEP:	24576:W0tsVyDiyjYsnyP0E4e+DXoKxYT1VR8VN2+SVT9bEmHO:PbjYsnyMEkDXoMYT1L85mbhHO
MD5:	D7428048EF491590738F2592D4D5B3C2
SHA1:	09DB4CD37FCBF18879FEE50B01EA863192E801B8
SHA-256:	FF59393A083C7415D3AC2733C1AF3398A173F1E91358112054096AAE8765BC37
SHA-512:	72CA932D72201DA729FFFECECDFFE6DEF1774B26B5808527CE11DB2E42ABFBC66BFC422914B51D16A93D918FDB741FC1FCDCD993A4852F53869281E97D65052D
Malicious:	false
Preview:	PK...........X...dup..p.......MSTeamsSetup_c_l_.exe...\|T..8...I..p..@...DEC5......l....1.DH.Uc.j......nVs..S..Sm..Vmi.-O...tCh6.....m.v.5H....s....&`........7.W..;?.9s...s\.>+..A.._...Y.....K5...o....z..f........U.+V~....=.~.}...}..x0}.....^..4..o?...c.$g.e.~[5c.Q......{...\..{....s.;Y.S.sN."...p.<...~4{.e..=#..XY..o..O......X......O...%.._...l..).....t.....u.F.h.X.P..k...N@..^..8...(..,v.)X'2$...D..ma...0.=._..Q8./.....})...<;S..LAxV....../...T\|Y-..K...(\|.......yS....m...I.Rn^..}.....^.o.2x.4.'.zso.......(0...#..o^.j......m...<...V>....X....,x>.22......o..5...!.p.~...~h..@..Qm..?-....PB?..p....!)&.......Be...o.. ....2.Q L.R......V.....q. ..s...6.u/c..3.W.5x...!.[.p...n..xB..H.[..-LD....~x.w....W.....I.V..Mc..i......E...~_fo..w+{k..m.m/..bo.....e...w...!/....S+....'Y@'....W.m....\.........~+.....U..~.9.5.?u..Bw.....+0..c^.....?...o..t..../#}...W......8.K...e?..z.:o.../.T.(UT...[...\.9.TE.3.r..(..~wi]....&.h)...1.$.}.(.#..>zc}$.-AXi......(...7.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PMW3U6MX\kd[1].zip

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	252340
Entropy (8bit):	7.997261733586372
Encrypted:	true
SSDEEP:	6144:aAabY8dy6aGVd/LbmqyLqWijkDz6n9il+tsA:aAabYCIG/LhyqSkt9
MD5:	1C2C15058C1E127DFC122295A7C5CBA8
SHA1:	0A96A14F7654C255FF9BC0895DE9100A371FDA55
SHA-256:	CB69CFD279ECACD4403A0EC94AC102063383B54035BCB6ED80C6FB8C1DF03597
SHA-512:	35B9FE409887AFCC42D79EFC44E1BE2ECCF86D658B3B643DCB293ACE5981BB25CC1889237C48C2BE93B8520DEC4FC765847627B52B0741AD6D35A56AED0F096B
Malicious:	false
Preview:	PK...........OJ.u.X.... ......KBDBGPH1.DLL.YkL\.....)v...K.;...6.f...?y....`......Z..)v. .......Oikw..n.n..8!..~8..TB......RUm....;w...Vj.x...\|g.s...?9......0......<.........(cF.}......!.....P.....a...G.U.Z....\nkj.z...MN..^..%...:.[....{._..q..fo.G..P..\.......-.Y.Z.-......i.;&t...a.%.......t..X-.0...+@+.U.(.....#.5..7.:...F...c.C....9.D..%.&\|..0v.......P.y...+......mL...>.6.<...6..;_....W...n..m..u....;1]....q......p?z...WA1s;.".....3.c..<.x%......1.e.......1/d^.<.y..\.9.e}...2....:.?..q1M<...c.v.L.t...y..ai.......7p,:.a.n.Y#...0M.r...F....=...(C......F.......X.y..k.9..........8....n.E..pl#..Y..m.D....bz.x.,.f.s..W...)MR........Xe.n.s.W..nx..=..U\.......z.g\|u..Oi...S.[."9q\|.q.c.C.X.r.Y....;...S..o.e/.ub..k...^.P..F\|=.n.x.U..I.....[...5,......c.=}..{1}?>.8.Yh..OIJ..ex..Tz.C2?:u.Jp.ww..w.p....{..{..<.^(^..r.LN..D....(^c}..w..(..-.O..pMl.....".~)..3a.w....6....(..(.}..WD5X..v......S..n..;D.d..`..-Z.N.)q.N.3pF.........B..W...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ka[1].zip

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	47196
Entropy (8bit):	7.98658385181407
Encrypted:	false
SSDEEP:	768:DN2KFAe0d+P+JkU1aDn4zcQwltlIOQFNAYuSYsknCdlGTyWiS3O66Ht:JH0s+WpT4RhFccEyWId
MD5:	311E0D848AA1037E8177C13BB4CD5DB7
SHA1:	AC14C1493668238039ADAAD792CAB37AD8532967
SHA-256:	D7F28424185E75FD9B8DB809C1B7178782EB17683BBB1862AF4B6435A5783CDC
SHA-512:	BD9148FE55BE2D8E0CC7C1ED87B9300F67EFA73227DF635E97DB9F751A6E13183FE33AEE9FD69AE6AB9C57C079AEDD37311B22B58BDE7F9A72AC6CA5325B5989
Malicious:	false
Preview:	PK...........OT,....... ......kbdarmph.dll.Yml[g.~.8...a.)..7..k.:.u.us>.:.[.Y..k...8.g'[.[...~ ..'?..`..l.....?......>T...`.0...F9...:.M.....=W..<..{.....]........7.y.....5z.\|...\Z.f..\|..7.I..Dl$..S.....u0.&&......W.b....\|....Y,o\|08v.x?Y....c.#...yL.....V.Vc.....Kq...{F."l..J.C..........).5._I......@...u..f.x...J..X..+..\".n3..7.9... ^....J.s.......z...s.i..g"......eW.kq&B..>'....,..._._...-...p../...=....i...M...F.?.x...W.\@.ft.q.w.....v.....3.c^.F.].G....1.e^........og...y=.:..k.k.5#...".A9.$4.X!.Xr....%9N/B...5..j.p...!..i..uR.a.N^...4.Z)/A-..... ...B.!..(.nLR}..L....u&\k.5&...M....M...L.m....hn.H.5.'..H.!S.{..aD.4.....N0n....i..S~R.O...!....q..U.{........;i..P.N./....).\|B.T....\<?.<Z..8.+zn...E...~.m....I.P...G..q.G...hQ............J.]k)-.o..""......ij.f%V.g..o..o..(..=...MiT&...5~....~..... ..$...].$K.....E.....#hZ>....x.c.._b...?........+.(......../..?.v.D8qA..#Q..h@Ll.V..y..v..F......D.....b.lb?...Nq...!...qX.....Kb..1....E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\T9RRWRNL\ke[1].zip

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	Zip archive data, at least v2.0 to extract, compression method=deflate
Category:	dropped
Size (bytes):	573418
Entropy (8bit):	7.998124134017101
Encrypted:	true
SSDEEP:	12288:+AQnPyLZdddjqMiKuuK7WHAieWY90YxVr0BgaLSr+nOPXmeX/piuLz:+AQPyLZ5FvFHj60YwVWlXhfz
MD5:	4CB315E7690EED288A6FB55F7ED1A06E
SHA1:	1D1476B06ADF9E19A255D18306F9B910F2296989
SHA-256:	BA68778BFD9C5CAC7CCB3F528EAC7B7C697EAC8971656175B8F3DFB9A8F20B3B
SHA-512:	8990E05494A21E0A917EF0E0FECE72647786BC7EC024FCECA540C440BA53A3B3A71A5682704A5126F3B0FF0CE7F607737A54429234D38F92597F6DC26602A379
Malicious:	false
Preview:	PK...........Oy:.W....."......KBDCR.DLL.X{P........E%..........P1O.%(....FY..V..]H.!o.Ggh.G.i.X[!.HX.nS&....Y;m:..`...tZl&.f.....s.w..]u2..I.7.....{..;...C..Tz...Q....\....K....F..z#kG.7`...Z..v[.....ek.....6o.......s{......./...~...i..x..kSL.z.>..I}......d.-..O...k..Xu1.m_0./.A`........>.3/.F.Ho>.(4nb03v...o,.da4c..T\Y..yM.....G....h&ftC..6...vu......,..z I.".?.o..P$}n.._...i.5.:.........i.YR...u...?...3Q...g[a...M.t.]e..o3.....&n.2....<;........ t..uB..........pK}..\|.yBs.:e.F..B7.]/t.....B.....6..:...M,O.:.f.../Rl\..X..F)jfE..xhdg..E..'.K....U...At...C;.Y......#.C%..9..F.]..,u...q...s.a...&.6.M..$....pn..=...l.uI. ..I...pa.. ..t.F n.z...V...U....Y..~..O.~.Z.......QL6-...Q..{.a+.R^o........9C.xm.U..<........A..B.m...q...hN....G....4O.s......9...'z....n...El$I3.O.l......3...F i=j%..B...X`H.~.TIR....[.....G..%.1[..k:..q'...-i5......_...k...".n".o.].&O....$.n!.k%O......P1.\|bZ_AcQC....+..........r..R.._\...3.U$...Op.`.......^k.....1.S.L

C:\Users\user\AppData\Local\SquirrelTemp\SquirrelSetup.log

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with very long lines (1063), with CRLF line terminators
Category:	dropped
Size (bytes):	21008
Entropy (8bit):	5.434899939251909
Encrypted:	false
SSDEEP:	384:HOtdaDmOrxOx4wRFlBm/LIVCSpAj4XAZyAb+B:mdaDBE3m/LIkn4X3Ab+B
MD5:	78709ED35354545A03666B6E06F391AA
SHA1:	F118414D1FFA16BE11CB63897E9BA98A310A85DA
SHA-256:	B937872E061CD9B78C31F2E34ED47E4666849F8EACB96449BDEF598E0EDB3645
SHA-512:	28C3693ACF077A8C17978331C5B83A2AD7B83D3F2F2B2EB7CBA1EC234BD15E88C8458F873EF5FAE5224754A11F35D41558C1A48221C4B43FE3392FBF4D397455
Malicious:	false
Preview:	.2024-06-25 15:01:40> Program: Starting Squirrel Updater: --install . --rerunningWithoutUAC --exeName=MSTeamsSetup_c_l_.exe --bootstrapperMode..2024-06-25 15:01:40> RegistryService: TryDeleteRegKey: HKEY_CURRENT_USER\Software\Microsoft\Office\Teams not found..2024-06-25 15:01:40> RegistryService: RegKeyExists: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Teams\ does not exist..2024-06-25 15:01:54> LogHost: Write failed...2024-06-25 15:01:54> LogHost: Message: Scenario.Status: success, scenario: d9e29373-f14e-4079-8fb7-971577ce0d73, Scenario.Name: desktop_squirrel_stubinstall, Scenario.Step: start, sequence: 0, appversion: , platformId: 27, DeviceInfo.OsName: Windows, DeviceInfo.CpuArchitecture: x64, DeviceInfo.OsVersion: 10.0.19045.0, AppInfo.ProcessArchitecture: x86, AppInfo.ClientType: desktop, dllSearchPathState: unset, clientType: desktop, source: exe, distSrc: default, breadcrumb: , SignedPackages: enabled, desktopSession: desktop-7c68a190-2550-4769-8a62-3e009f1829c5, installSes

C:\Users\user\AppData\Local\SquirrelTemp\Update.exe

Download File

Process:	C:\ProgramData\MSTeamsSetup_c_l_.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	2587536
Entropy (8bit):	5.8722573216040965
Encrypted:	false
SSDEEP:	49152:n6vefAQban/ZfJjXQQ3hBe+tnAXaJsxh0YzCeSAeZ3G:n6ve4Q2n/ZfJLQWhBe+tnAKJy7CeSA5
MD5:	8F0E958D7EF57D727ADCDA1C67C24C2B
SHA1:	DA68956F5E16C2D76E87367487C2A82A6B8025CD
SHA-256:	4955CC6E58049EF1E274F340C8425CC55B324278199C92AC0DE87DF05BFAD35D
SHA-512:	BBC325E94390053AA6D667D1FE3869772E788370F5CEA9298FBFC8CFAB73392DB719F943C7E757693CB2AB80174B3FBEB40ED9B487B9CCF5CC748BCC6AD85558
Malicious:	true
Yara Hits:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...$T.e.................z$..........$.. ........@.. ........................'......h(...@...................................$.K.....$.\.............'..M...`'...................................................... ............... ..H............text....y$.. ...z$................. ..`.rsrc...\.....$......\|$.............@..@.reloc.......`'......,'.............@..B.................$.....H...........................X.............................................{......{......{....r.(......}......}......}........0..S........u......,G(.....{.....{....o....,/(.....{.....{....o....,.(.....{.....{....o.......0..K....... .A. )UU.Z(.....{....o....X )UU.Z(.....{....o....X )UU.Z(.....{....o....X*..0...........r...p......%..{.....................-.q.............-.&.+.......o.....%..{.....................-.q.............-.&.+.......o.....%..{......................

C:\Users\user\AppData\Local\SquirrelTemp\background.gif

Download File

Process:	C:\ProgramData\MSTeamsSetup_c_l_.exe
File Type:	PNG image data, 440 x 248, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	8784
Entropy (8bit):	7.902641651176422
Encrypted:	false
SSDEEP:	192:BSJGHdn/Q+Uewe0x/JpeuIZTZzM6MEW+ZABCXTpETPK0hX:oQHdnId/JJSTZzM1MGCVETi0N
MD5:	FF1F29DCA0451246C3CA6CB7B023434F
SHA1:	B26BEA187F072D9A401B7FD06661492418B893EC
SHA-256:	753D7D351E427246E2B6CC86C45E21F952939E306C3EB2FDB1BD7D67842C64B8
SHA-512:	AD3D2BAC2ADA88CBA32567A5C2DC67C7B4E3A0D0834C262E577DD77BF3B38CD60B35DF72407CBEA256343CED449D9C7C01D0A6EE58EB8D1188695359F47E15F2
Malicious:	false
Preview:	.PNG........IHDR................k....pHYs.................sRGB.........gAMA......a...!.IDATx...}...}.....=.....A\|.,.'....4"....&.h.EH..Dn.V...Vb...k..Z.......0....:nL!pK.p.R.U..c..%.G.<.).......fgg..vov../c.;..h>..~..M.8q.....&..8v.....'O..... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H......q..R).P...PCC.....?-.z{F.\|k6t...dd..V...6......j.N.O.nRn.-.....~xnB6...?.h.\|xo...-..X..;..?..[....0...n...&..~.GV.S.... ..J.~>)'..~.....;sr.........v.G..Ux..q.._...d..hr.S.cL..2!.....*t..S...z9..q....X.......}.{.Ro....72#..G..e.1..R.f.(.\.......!..2.H.Z.()..<....1.......A+..._.~..=?%sssR....=....N$....e.>4-7o-}s.aG.]......z..k............ek...#..?.^.?..#.8..P.V<o.bZ........ykR....Ko.\......{.gw....&..w...4Q.%h.-e.[........=?"...

C:\Users\user\AppData\Local\SquirrelTemp\downloading.gif

Download File

Process:	C:\ProgramData\MSTeamsSetup_c_l_.exe
File Type:	PNG image data, 440 x 248, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	9016
Entropy (8bit):	7.9037256871196355
Encrypted:	false
SSDEEP:	192:BSHYMeY9ayCss7Db0cvhlCZMNvgKiMKEl7eJ1XDw65pz:obBlCsyDb0cvbCSmEo1XDvz
MD5:	3488A1749B859E969C01BA981036FAB6
SHA1:	A65B72461FA14C89FCE0D025E43454830A1F7972
SHA-256:	C3FA333FDBCE95D504AEE31912993DC17AB31324428F557AC774F7E98B049B99
SHA-512:	7363003422BDAABB7943439EE1E846867F0F3D0BAED3456424544A81989BD2D142A411CF982D90E4158314D410CD1A1A4EE33D8707219B4274CD2841705BCECC
Malicious:	false
Preview:	.PNG........IHDR................k....pHYs.................sRGB.........gAMA......a...".IDATx...y...y..gzN...=<.K.xX.Aj.....Ey..hd. ..#...+...Z..../v....v.?....Fd..S@....D..'...!eY!)96IY.g(..C..W.........k...k....]wu....}.:u..1G..H...q..a.. )..?.M..@..p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....H... ..8.@".p..D"....D........$....H$....Hi.P3....K.R....8...>....iB~.....T.:..K...-..#...E.....T........\.6Ut].>}.....^....p.\|bW........[.../.;.Vl.-...2...Q....e.Tt@.0.........Xq.........]9..hh.....p@.^.cD..gC26V.0..w.....7F....p@...t\...#R+'.?".....sC..e.>.o.oHj.......&.@..8.D.7..B..,.E.+.X333..2..P"..X..%..'g.>....!...h%..3../..g.ezzZ.A.R.>.5....{p@...&....o..>...q.oCsE..:w.C...A9......Y.by....-....d.}............MH\....w..@......;r..{.........i.;.u.....zU..IA.%P...\|...i_..T....3..w.\(.

C:\Users\user\AppData\Local\SquirrelTemp\endpoint.json

Download File

Process:	C:\ProgramData\MSTeamsSetup_c_l_.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	4.928890348969296
Encrypted:	false
SSDEEP:	6:Yr1VXl/H7n+D22e9TOXJatgKG9ik8N5KATrKG9iM8N5KATEEKG9i7kT8N5KATJP3:Yr1Jl/bn+DBetOXJa0ik8N4AHviM8N4H
MD5:	677CAB9A8B50AD026CFA7625A35DD2D7
SHA1:	236780C5FBF2D5607F7CB165549584C9153112A2
SHA-256:	07890DDA20815E1E57DCA9553F5DFCFF1B85F4A4369685D4991599E2618978F0
SHA-512:	D1863063926B405A6BADE3327CFDE25983D94E626D568ABBDBDFF9AE95E00061ED9CA80CC03A826C2144E4469A2734EA887A6C56AE0ED0CAF70CE0077D219162
Malicious:	false
Preview:	{"pdsEndpoint":"https://teams.microsoft.com/desktopclient/installer/windows/","fallbackNextGenAppPayloadUrlX64":"https://aka.ms/maglev-x64","fallbackNextGenAppPayloadUrlX86":"https://aka.ms/maglev-x86","fallbackNextGenAppPayloadUrlARM64":"https://aka.ms/maglev-arm64","getInstallerEndpointUrl":"https://teams.live.com/downloads/getinstaller"}..

C:\Users\user\AppData\Local\SquirrelTemp\setup.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	37
Entropy (8bit):	4.063335204640661
Encrypted:	false
SSDEEP:	3:Y1AohbpTZJ4n:Y151pr4n
MD5:	F57CCF6F5B9C1E2AAC3C144605B53AA5
SHA1:	97B96FB910D992E53C305CA7D93CBC396567B0F8
SHA-256:	A92CCAA545B4AF7A81AC10C260291C3C33FB68197D150F8A42D1FBF74EB27648
SHA-512:	D7959CDEFF648169F967F4F09771C1D6466929C8120D31064570CAB88F83D14041A4CC56F09019799770189F55CCAE89AAD18BF40AC788A717CB1ADE1F52F957
Malicious:	false
Preview:	{"--exeName":"MSTeamsSetup_c_l_.exe"}

C:\Users\user\AppData\Local\Temp\.squirrel-lock-7E50F52EC714C8319D0A96EF1BA7B246C79A298B

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ISO-8859 text, with CR line terminators
Category:	dropped
Size (bytes):	4
Entropy (8bit):	2.0
Encrypted:	false
SSDEEP:	3:9:9
MD5:	A7E0F8AC46398A7876D1E40DD52C2AAB
SHA1:	B66922B4E6F09E23C072E4AFF49C67C3121DD5AF
SHA-256:	05174BBF0D407087E45B12BAAE17117426852FF3A9E58D12A0EBB9A10B409743
SHA-512:	E6B93215582F7F4F5E9292273A9466B5D0CC3A4EA7D77AE42854203755441DD5EDBEFB11FE8890CAE7783E41E2EDBF61EC7B03D7E5E9870A7821D4016B095F79
Malicious:	false
Preview:	....

C:\Users\user\AppData\Local\Temp\a539a915-e8b3-48c8-bf7a-59cf8f6851a6.png

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	MS Windows icon resource - 18 icons, 32x32, 16 colors, 4 bits/pixel, 16x16, 16 colors, 4 bits/pixel
Category:	dropped
Size (bytes):	172066
Entropy (8bit):	4.32521391566617
Encrypted:	false
SSDEEP:	768:Dg7Z3gHhMIW7F3TGUhxkZ1OgbC6kStqJ1L3mC3g9BQ0MRB3R9HwXOeOkccOOOOJW:07Z32hLWNTJhxiQACPStqzZw9ep3RV
MD5:	247D14144A313421D8D84AA0EA54D249
SHA1:	83BEFDD6EBA57FAA3D3074AA08A28A4E8D75076A
SHA-256:	2D5AA67B8ACE13A94FD09316787E3C9ABA2ADAC767B6E2AB769A2265A2AD20F0
SHA-512:	F2D79A2A75148EFAF90A4A92980E781B1F94A4A1034383FFE5749983085EF7EAFA29D4804094296B212795501B4B4A126BC47C24A91B60C24104BC4B24D99565
Malicious:	false
Preview:	...... ..........&...........(.......@@......(...6...00..........^... ...........*..........h....2........ .$5...8..``.... .....:m..PP.... ..g......HH.... ..T...i..@@.... .(B..R...<<.... .H:..z...00.... ..%...:..((.... .h...j`.. .... ......z........ .....z......... ............... .h.......(... ...@....................................................................................................................................................................................................................................DDD\|...\|\|x...\|\|\|\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L...\|\|\|..\|\|\|.\|\|\|H...............L........\|.....\|@.............L...\|\|x..\|\|\|\|\|\|\|H..................\|\|\|.............................\|\|x..........................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\AudioCapture.dll

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	78840
Entropy (8bit):	6.635830973981154
Encrypted:	false
SSDEEP:	1536:96Y+zbZm8/v/k957pyPkLDfORFMTlrSWqNj5CdnTrioQ+ywlj5CdnTXZQ+8iA:96Y+HQ8/3k9RppYFclrLqNj5CdnTrIwp
MD5:	2A82792F7B45D537EDFE58EB758C1197
SHA1:	A039182D4D1EF29C6D8C238F20F7B8218C28F90C
SHA-256:	05AA13A6C1D18F691E552F04A996960917202A322D0DACFD330E553AD56978ED
SHA-512:	C6C6799B386E0D6489D9346F1D403B03B9425572E7418A93A72C413A4B9413945AAF4EA97A7D7B65772E5E3F00CFF65F180F6FEF51A26D4FDC2FF063816B5386
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\CSCOClient\AudioCapture.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........\...........7......................:....................2......3......4....Rich...........................PE..L...gf.a...........!.....\|...d......E1............0.......................... ......................................@...-...t...P.......h................O..........`..................................@...............(............................text....z.......\|.................. ..`.rdata..m6.......8..................@..@.data...`...........................@....rsrc...h...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDA2.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	3.215063512499068
Encrypted:	false
SSDEEP:	96:SNFyw+5uvUK6w7N2dlI6wI/bApy4nBv70aWSQfWwd3vv:SNxU87Ydeqiv70aWffWu
MD5:	214AA73291F6AB887EF26A66BCE94AED
SHA1:	3CA58609A7E910E32E2DC5E112ED80DDE976853B
SHA-256:	BA86BF23A8B6FBAA94749D572D9DF0C1E8BBE50F709B8179B52F8FDFFDB5429D
SHA-512:	9E5ADFBD95FA99C35ED4FA74CE6F9B3E8CF7580ADACC0613B9C024B9F25C51806025F309567621933E342ADB20ADD8FD90BC62CC2DB51AAADD9F4AC918C59D56
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d...,Z(5.........." .........................................................`......9.....`A............................................P............@.......................P......@/..T............................................................................text............................... ..`.data........ ......................@..@.rsrc........@......................@..B.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDA3.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.0585944373749823
Encrypted:	false
SSDEEP:	96:tNFyw+5u2TK6whIdlI6wI/bApy4nv4NUj+WhOWwd3vv:tNkT8ydeqhNUj+WhOWu
MD5:	37090A2BB21DA2366531725D277007E8
SHA1:	131FA250251591F50080E139E9659AED83EE5319
SHA-256:	E8D963E1204AB7D0FF1438ECFCCC1E87E30C9DCF528158A84B0117E1E5566C6F
SHA-512:	E900F2A06D8AB8FD03077B62624AD4AC52A141305E0320E3CC2618A3D14E615306E2121C1AEDF6746CB0FAC2CB4B21481417CFF86A873B8D7EAA769D9BE265BD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d....Q............" .........................................................`............`A............................................P............@.......................P......@/..T............................................................................text............................... ..`.data........ ......................@..@.rsrc........@......................@..B.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDARME.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7168
Entropy (8bit):	3.126190356593496
Encrypted:	false
SSDEEP:	96:IdAt6lZCwVdk11DTw93Rmfpcsg3qpjVdW6UPWwIkfP:IiHidk/Hq3Rmz9dW6UPW+f
MD5:	7F5AD86B9F7CCC7F7CE9D4E5170A94E6
SHA1:	206712263F51F6A9E5A4AE4FAC163CC329E781B7
SHA-256:	415CE966256939094BB504556D27DA6578C31B7E95CC2C8FF2FE7EDEA3A2A28B
SHA-512:	3A40A5B496543B1D0172D6E92AB9F39554BF8EECD48DE0CF24B4A36CF42E1C0DE8B9ACF416273E112F509D0CC39E39143FC2451DD9EAFB5D1A89FEB5A6D1585C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d................" .........................................................P......z.....`A........................................@,..T............0.......................@.......,..T............................................................................text............................... ..`.data........ ......................@..@.rsrc........0......................@..B.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDAZE.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.026787202957076
Encrypted:	false
SSDEEP:	96:xNFyw+Y6V1DvI6IRq+3ObApi4nw0fZWz6WwOvv:xNd6fEt4+3kyfZWz6Wt
MD5:	3BC5018FED7C1C313ACB5129494BE0FE
SHA1:	757AE42A023FCFA8566194530AB10042DD196672
SHA-256:	16CE54B798B22C91C0A583C96E782F96510E25181242B4733FA19B8882EBC55C
SHA-512:	759D1B4A44CEF1049F62E716864E2BCAFFBD3843A04477143C658E73F5F378C937BEC94468CDF8F1071A238690A5AFBA12E2F191DC593B3F77DAD059C990A915
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d....Mf..........." .........................................................`......*\....`A............................................P............@.......................P...... /..T............................................................................text............................... ..`.data...h.... ......................@..@.rsrc........@......................@..B.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDAZEL.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	3.100330786711219
Encrypted:	false
SSDEEP:	96:aNFyw+J6V1hvI6g1Rl0zbApi4nL3sWiXGWwsvv:aNU6fC31D0/usWiXGWH
MD5:	B0C67CBF87A8BA04A3CC139853A26691
SHA1:	AB3100CD12495D98A4D3FA06883C899174267E3F
SHA-256:	6B52E12C5C2A903B2F534A9DAF6892DEAC3C5310AF1BA20FB7F973BAC981D5C4
SHA-512:	DA7AF0489638D99F1F1EC49E9D17EC7E6A2EAA028B7C9411AE7B862C6F9E96ED7D254405A726E30956803D7FD937A5100548BB717FDEFAC4D7879C1EF5BD127E
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d..._............" .........................................................P.......h....`A........................................P...T............0.......................@..........T............................................................................text............................... ..`.data........ ......................@..@.rsrc........0......................@..B.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDBASH.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	3.15982308079794
Encrypted:	false
SSDEEP:	96:mNFyw+J6V1AvI6+lVRmN/PbApi4na/+Wk9EWwsvv:mNU6fbBPRmN/jZ/+Wk9EWn
MD5:	8F18572D916E66234D6C978E66DE2516
SHA1:	3544E5A7217EC2946107CB14C4B149C6B37352D4
SHA-256:	DF6ABEE90B0753615ACBDF46C31F3A6E40C815121614A8B7D787A8039475F1E0
SHA-512:	6FD56F02463FB2B742A2A4649B8C42C3689AA96B567C8E35180C058F5315BE78901E6800CC54DA854F0C996B6D46CF4AD3AB157D823336DBC941F7D0D67C3E82
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d...N............." .........................................................P............`A........................................P...T............0.......................@..........T............................................................................text............................... ..`.data........ ......................@..@.rsrc........0......................@..B.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDBENE.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.199490092217414
Encrypted:	false
SSDEEP:	96:tR6Sfq6FiJc+ING1uDlc0i9c3uU+Y1gWoXpYWw:tfqyRNKuRc01AW2pYW
MD5:	30E9E5C7CB480BB699BAF1E3EB1B5849
SHA1:	E4F6A23BC1EFD1A1392D0B988C4A71D038FDC1FD
SHA-256:	DEDAE638643A97E722AA5208701C8D1FB589FC3E6C3609C114DECB25A13CECFB
SHA-512:	776B95E4646C4E796F6974C3EAD42FA4BC95A252DFBD7A2B6B27BB8DF072294354D7B4754317137ACC78F359DE9D37928F6792B140BCE1E2F8CC3FB2795436ED
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d...yY............" .........................................................`............`A........................................00..T............@.......................P.......0..T............................................................................text............................... ..`.data........ ......................@..@.rsrc........@......................@..B.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDBGPH.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	3.104098452518941
Encrypted:	false
SSDEEP:	96:m+NFyw5a01przSv5kuEMpi4nKXW50epWw2vv:m+N40pyv5k/XW50epWF
MD5:	A9849493D69218E6587E688E6EF5BF71
SHA1:	E50D8265E4424090464FFBD0EA4ABF6BD0178530
SHA-256:	2111A08CA2C2EE1746F85BC20346C2B50AC612F2164611DAC8FB32682EF71917
SHA-512:	DEB702C5C3371B0AA90817728823F267C5D83BF84591FC1C29708A5759BF4C4F6915B708CBE380443638F8A719A3E8E58846E754E2403D43913CD84687CCD9A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d....T............" .........................................................P......Y+....`A.........................................-..T............0.. ....................@......@...T............................................................................text............................... ..`.data........ ......................@..@.rsrc... ....0......................@..B.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDBGPH1.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.0110958074128034
Encrypted:	false
SSDEEP:	96:ZNFyw+J6V1AvI6vCQbbApq4nnuatIWPQnQWw2vv:ZNo6fb2CQn6ltIWPQnQWV
MD5:	124BE893E254E0C0B22EA1BD56EEE616
SHA1:	E8D36A2359D177A45ABF62A4AD4470D72B8B59A4
SHA-256:	EEC523E279B640E4E74DA2B376A5846D2B9F4770219587095CEAAAF05DC03C4C
SHA-512:	AEBBAFAB7E3724A2E8E54F760CBB9654F798836AE13B27442B80921ED3C65C5DCD606DF55AC79ECC6646EE671C0081D56D43A6A8B323133C732A34DFCABB4E60
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d....cjN.........." .........................................................`............`A........................................`...T............@..@....................P..........T............................................................................text............................... ..`.data........ ......................@..@.rsrc...@....@......................@..B.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\KBDBLR.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	7680
Entropy (8bit):	3.0545086525369567
Encrypted:	false
SSDEEP:	96:f2ggNFyw+cmoO1BzRSilI6wFbApq4nINOhtWv4WwYFvv:eggNrS5RSieDxKtWv4Wj
MD5:	F7761CE5F1D1B7193AAAB39B8B0E6B37
SHA1:	A502E3140ED1EFD1D7D050286863F9623EEF79FD
SHA-256:	2A92F80FF3BBA6B3FDC1F7350812EE02B863F335819330F2537D5B7F2E9DE087
SHA-512:	9A5079E017C36A55ACD92023BA535A54120C40604ED216E9B9214E666CEE69C1FD396BA0F98590878822181555A41640B8FA4B6D9BCBB6452DB6CF78BA1C1B92
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d...F`.j.........." .........................................................P.......p....`A.........................................-..P............0.......................@..........T............................................................................text............................... ..`.data...H.... ......................@..@.rsrc........0......................@..B.reloc.......@......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\NSM.lic

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	262
Entropy (8bit):	5.159412672243952
Encrypted:	false
SSDEEP:	6:O/oPuHk4xRPjwx35vydDKHMoEEjLgpW2MOzx7oUIXZNWYpPM/ioeU6a8l6i7s:X0ZR7wxDJjjqW2MORzaNBPM/ioeUH8lM
MD5:	B9956282A0FED076ED083892E498AC69
SHA1:	D14A665438385203283030A189FF6C5E7C4BF518
SHA-256:	FCC6AFD664A8045BD61C398BE3C37A97536A199A48D277E11977F93868AE1ACC
SHA-512:	7DAA09113C0E8A36C91CC6D657C65851A20DFF6B60AC3D2F40C5737C12C1613C553955F84D131BA2139959973FEF9FC616CA5E968CB16C25ACF2D4739EED87EB
Malicious:	false
Preview:	1200..0x27aa3c3....; NetSupport License File...; Generated on 15:44 - 29/03/2014........[[Enforce]]....[_License]..control_only=0..expiry=..inactive=0..licensee=DCVTTTUUEEW23..maxslaves=100000..os2=1..product=10..serial_no=NSM896597..shrink_wrap=0..transport=0..

C:\Users\user\AppData\Roaming\CSCOClient\PCICL32.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	3707208
Entropy (8bit):	6.519614556761325
Encrypted:	false
SSDEEP:	49152:oVkdI/4amDppYTV665qlvEbaK3M+T6alaPclSpc5tEB:oVIG4amlIV5qlwaKUaHSwtU
MD5:	0806DD2FAF75EF07931F0A0148DABE8A
SHA1:	D578F3590AF19108A45F1053E7752C72E4E71757
SHA-256:	1BF1D7E36A7FCAE7D5DF7A5B926FFD5FE07ECC3B3412D7818A9139F501083C51
SHA-512:	8C4628DA32F25B10F432C7B5AF03BD76368F44D8C9C017502E79C1A53548635A4C12C489BDD775BBEA888DBAB3A51859403E64CA79E39B0938260F1819936EF7
Malicious:	false
Yara Hits:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: C:\Users\user\AppData\Roaming\CSCOClient\PCICL32.DLL, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\CSCOClient\PCICL32.DLL, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........h..........<G.............-..........q............q.....q......-.Q....,.\|.....................Rich............PE..L...u..U...........!.......... .....mZ.......................................09......o9....................................T}.......................x8.H.....7.........................................@....................v..`....................text...L........................... ..`.rdata..............................@..@.data....!..........................@....tls.................f..............@....hhshare.............h..............@....rsrc................j..............@..@.reloc...+....7..,...L6.............@..B................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\TCCTL32.DLL

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397176
Entropy (8bit):	6.805828808723932
Encrypted:	false
SSDEEP:	12288:T63kUb4Rtmiqcn1gqjamCcmAPFdOKAeriUAb4yfytX:V5e+mCFEK6bffQX
MD5:	E5C78D4F6A7A886BD5A19A5F9B654A09
SHA1:	D38231380D37981BE65D0FA84E0001F4DDCC568C
SHA-256:	198CA24C0EF0D879CF475DCA9E0858DA4220F8624AEDF815C76CF33D0316C2B4
SHA-512:	E2BFD445B83A53B3F797EFBA4C8FF873CD99CF3B78D2CBDAF1005F09172DB21199E48E19268DD4056F9FF5EB7885CC9192FF7C49E79F8FBE8D69948920887683
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............z..z..z.....z.....z.....z..{.Y.z....K.z......z.....z......z.....z.Rich.z.........PE..L....HwX...........!................w................................................(....@.............................o...T...x....0..@...............x)...@..\E..................................`d..@...............h............................text...,........................... ..`.rdata../...........................@..@.data...h............~..............@....rsrc...@....0......................@..@.reloc..$F...@...H..................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\client32.exe

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	55456
Entropy (8bit):	3.9089814840046824
Encrypted:	false
SSDEEP:	1536:HtvrImfzoXK6DDvvvDvpvZMt+pan/opgRl2:lImfzoXK9/o66
MD5:	9497AECE91E1CCC495CA26AE284600B9
SHA1:	A005D8CE0C1EA8901C1B4EA86C40F4925BD2C6DA
SHA-256:	1B63F83F06DBD9125A6983A36E0DBD64026BB4F535E97C5DF67C1563D91EFF89
SHA-512:	4C892E5029A707BCF73B85AC110D8078CB273632B68637E9B296A7474AB0202320FF24CF6206DE04AF08ABF087654B0D80CBECFAE824C06616C47CE93F0929C9
Malicious:	true
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........H..&...&...&.<.{...&...'...&.@."...&...-...&.x. ...&.Rich..&.........PE..L....Y.K............................ ........ ....@..................................'.......................................0..<....@...r..........P...P............ ..............................................X0...............................text............................... ..`.rdata....... ....... ..............@..@.idata.......0.......0..............@....rsrc....r...@.......@..............@..@........................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\client32.ini

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	650
Entropy (8bit):	5.419011836086886
Encrypted:	false
SSDEEP:	12:ZWqH+WX4Ba/vmZ7CVVePfNMQGS+u8o94ekLXJCYubluRAc8aWACPGY:kqeV8u9MQyrq4eezu9+Wdf
MD5:	58F6DE6B53D8118B02987F869D8E2543
SHA1:	BE116CCC31CFA3E62CD9B30B9542DD5FBDE26ECB
SHA-256:	6C73A60110764EEF51CA3EE1DF1E03D6E53B9F9513805C3948E947A7F49690D8
SHA-512:	2CB225EA149514DDF61230ABE305F00BD503CE4F8A04A1761469379BFCA09E20EFDA9567C53D1240E31C7DF492561DBAAD942F07F40AA92CE3BDF4EBF4DE59D7
Malicious:	false
Preview:	0x33442c48....[Client].._present=1..DisableChatMenu=1..DisableDisconnect=1..DisableReplayMenu=1..DisableRequestHelp=1..SOS_RShift=0..DisableChat=1..Shared=1..ValidAddresses.TCP=..silent=1..AlwaysOnTop=0..SOS_Alt=0..SysTray=0..UnloadMirrorOnDisconnect=0..AutoICFConfig=1..DisableMessage=1..SOS_LShift=0..Usernames=..SecurityKey2=dgAAAIX19hb8xhMgWZ3YoleiYzcA..Protocols=3....[_License]..quiet=1....[_Info]..Filename=C:\ProgramData\regid1990-09com.microsoft\client32u.ini....[General]..BeepUsingSpeaker=0....[HTTP]..CMPI=60..GatewayAddress=nld360.com:443..GSK=GP;D>LBPHF=DAFEF9F<GAMCN..Port=443..SecondaryGateway=nld360180.com:443..SecondaryPort=443..

C:\Users\user\AppData\Roaming\CSCOClient\kbd106n.dll

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	3.0382580163616995
Encrypted:	false
SSDEEP:	96:t77y6Z9B3w+QEf9Rrm2uivbbVx9J7J1EkFMBWc1TVWwR:pZz7lZ3Fbv9B3MBWYVW
MD5:	8C6585286D4F6794FB388BDF842DF1E4
SHA1:	9A354053A9FDAFD001AAB587D529A54B7789887D
SHA-256:	FCBA03F56190EE7D8E37375FD0D3B5DEA987B040B8AD91B0E83F53D6E8ADC52E
SHA-512:	82618947E58A29C183EE6F79D39F583D9A75B779E197125CD8A8EBB5E4E9D953C158E6A9C5ABB97C624277CFD4F5E99B04609DC8E608975DBF5839F93D8BBBDD
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d....%.s.........." .........................................................`............`..........................................0...............@.......................P.......1..p............................................................................text... ........................... ..`.data...h.... ......................@..@.rsrc........@......................@..B.reloc.......P....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\kbdarmph.dll

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8192
Entropy (8bit):	3.0645592445716225
Encrypted:	false
SSDEEP:	96:mONFyw+W6V1DvI6dZKjCztd/ibApq4nFtM1tWHSWwmvv:mONX6fEYZDzrYOtCWHSW1
MD5:	EDC488CADC3155607C374599F7C7B8AC
SHA1:	B9C49480CC0424BAC70074BB2F08C339E259932E
SHA-256:	30A73F927A7F6EE55E936583D5AB8CDF43E59A413D47CF6824AA10BAF9FE482F
SHA-512:	0B5CC194AF6C1ED1767C50F2CBAA969A994FB50B706FD4D21376C5BD2D5E2B33E66EDEC2D3A5AB235C01ACA98AE7CD76EE0F26FF9886DE8E4ACB25D411A13DAF
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d...[-............" .........................................................`......h.....`A............................................T............@.. ....................P...... /..T............................................................................text............................... ..`.data...l.... ......................@..@.rsrc... ....@......................@..B.reloc.......P......................@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\kbdax2.dll

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32+ executable (DLL) (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8704
Entropy (8bit):	3.0592992393259286
Encrypted:	false
SSDEEP:	96:vfD5ZoTwJKha1afv1bV91dlP9fmWfuWB3Wwt:lZYhYE1r+WfuWB3W
MD5:	42444F5C818D956841E83FAA05B0BCAE
SHA1:	FF1BC05714F018EB2C4C4AF1C3D6D62A2794A145
SHA-256:	093238B8F36223C94ED2502B7A6B98F2F1C661F4ABC16F1A57D47DA8A7208CD6
SHA-512:	C629BC2A42424F20DFB19084AABCEF74C9E1A88E9AA68DD0D98E9BCEDCC5FFD91AC861C4F8E78B45092069E8640218675F2A428AEA7C5ADF2304FFEF0BC3230C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............bm..bm..bm...e..bm...m..bm...i..bm......bm...o..bm.Rich.bm.........................PE..d...mZ............" .........................................................`......N.....`..........................................0..p............@.......................P......01..T............................................................................text... ........................... ..`.data...h.... ......................@..@.rsrc........@......................@..B.reloc.......P....... ..............@..B........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\nskbfltr.inf

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	328
Entropy (8bit):	4.93007757242403
Encrypted:	false
SSDEEP:	6:a0S880EeLL6sWqYFcf8KYFEAy1JoHBIr2M2OIAXFYJKRLIkg/LH2yi9vyifjBLWh:JShNvPG1JoHBx2XFhILH4Burn
MD5:	26E28C01461F7E65C402BDF09923D435
SHA1:	1D9B5CFCC30436112A7E31D5E4624F52E845C573
SHA-256:	D96856CD944A9F1587907CACEF974C0248B7F4210F1689C1E6BCAC5FED289368
SHA-512:	C30EC66FECB0A41E91A31804BE3A8B6047FC3789306ADC106C723B3E5B166127766670C7DA38D77D3694D99A8CDDB26BC266EE21DBA60A148CDF4D6EE10D27D7
Malicious:	false
Preview:	; nskbfltr.inf..;..; NS Keyboard Filter..; ..;..; This inf file installs the WDF Framework binaries....[Version]..Signature="$Windows NT$"..Provider=NSL......;..;--- nskbfltr Coinstaller installation ------..;......[nskbfltr.NT.Wdf]..KmdfService = nskbfltr, nskbfltr_wdfsect....[nskbfltr_wdfsect]..KmdfLibraryVersion = 1.5......

C:\Users\user\AppData\Roaming\CSCOClient\nsm_vpro.ini

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.532048032699691
Encrypted:	false
SSDEEP:	3:lsylULyJGI6csM:+ocyJGIPsM
MD5:	3BE27483FDCDBF9EBAE93234785235E3
SHA1:	360B61FE19CDC1AFB2B34D8C25D8B88A4C843A82
SHA-256:	4BFA4C00414660BA44BDDDE5216A7F28AECCAA9E2D42DF4BBFF66DB57C60522B
SHA-512:	EDBE8CF1CBC5FED80FEDF963ADE44E08052B19C064E8BCA66FA0FE1B332141FBE175B8B727F8F56978D1584BAAF27D331947C0B3593AAFF5632756199DC470E5
Malicious:	false
Preview:	[COMMON]..Storage_Enabled=0..Debug_Level=0....

C:\Users\user\AppData\Roaming\CSCOClient\pcicapi.dll

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	45112
Entropy (8bit):	6.86518195777479
Encrypted:	false
SSDEEP:	768:3o6OZSOe0iI6IdE+OPCH4mf6u0Qn+6wwbiRGp9E+yhwBkbp9E+8iROr:3o6mSOqIqPCYmfRnlwwbioQ+yhwBkbQ1
MD5:	9DAA86D91A18131D5CAF49D14FB8B6F2
SHA1:	6B2F7CEB6157909E114A2B05A48A1A2606B5CAF1
SHA-256:	1716640CCE74322F7EE3E3E02B75CD53B91686F66E389D606DAB01BD9F88C557
SHA-512:	9A98E0D9E2DDA8AEFA54BDDB3C7B71501D638DFF68863939DE6CAA117B0E7BF15E581A75419EF8A0DA3F1C56A19F1B0F4C86D65F8581773AB88FF5764B9BB3AA
Malicious:	false
Yara Hits:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\CSCOClient\pcicapi.dll, Author: Joe Security
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........~....Z...Z...Z...Z...Z...Z...Z...Z...Z...Z..Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...Z...ZRich...Z................PE..L......^...........!.....6...........@.......P............................................@.........................`c.......[..d.......x............d..8L..........pQ...............................Z..@............P..X............................text...~5.......6.................. ..`.rdata.._....P.......:..............@..@.data....r...p.......P..............@....rsrc...x............R..............@..@.reloc...............Z..............@..B................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\CSCOClient\remcmdstub.exe

Download File

Process:	C:\Users\user\Desktop\Teams.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	69744
Entropy (8bit):	6.597732994360204
Encrypted:	false
SSDEEP:	1536:rfanvXuNOwphKuyUHTqYXHhrXH4xLIygAormAWXiJ:LanPSpAFUzt0xLIygtgk
MD5:	A67623B4D8C86858115BEE9278B7A742
SHA1:	58BF04265A09EC5E3483CCBC459241C67E928FC7
SHA-256:	B0177CFB8F4D5DFB5C3EC3181CDDABA157771921C1F26C17AED736A605153A0B
SHA-512:	BA1F1FBCB32349DB90C90FF28DB5F7B74452A0629882531222383A5A4ADBF62C31B181B49729C0A1CD971F0C39C6EC33CFE4912C25FBA7430437C7D6F71A9056
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......g.V#...#...#...L...2...*.r.&...#...t...L.K.u...L.J.>...L.{."...L.\|."...Rich#...........PE..L......^.....................J.......!............@.......................... ......9?....@....................................<.......T...............p@..............................................@...............@............................text.............................. ..`.rdata..,%.......&..................@..@.data....-..........................@....rsrc...T...........................@..@.reloc..p...........................@..B................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Teams\97fe5e9d-8a0f-4f0f-a081-7b053ddb96a1.tmp

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.595102494251554
Encrypted:	false
SSDEEP:	6:YKWCRgXt9RdrtybHJXft3vkXeyzb/Pk+pMKx2Q/WKmo3xHJ2Wk3RdaNLzBmEcB58:YKWSg99rrt+pXtCB3kcx/p2WecfyqV
MD5:	59572E5CB2B9990005BA7054E027F7C8
SHA1:	2E1AD49AB545B4E1DBCBE8E8A0B649760805B749
SHA-256:	922B8A7A516BE5DA5C2C69A6E300C8592F4B8F0AE4F94DDA64DE7BDBE4415200
SHA-512:	6F8554E84DD5435D6849475D3C716747F3E43B074FB0639241798737AC80FF62A63963B1BCF3AB1D515BFE7FE1686E5EE8EF32249C5A43D22FADAE64FADB594D
Malicious:	false
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACNX62TarVhQY6QpyLm8bPJAAAAAAIAAAAAABBmAAAAAQAAIAAAAHIu9hiUcsbh0j7EtNxWmZzY9aZId4uZfNtlWpW4QIo5AAAAAA6AAAAAAgAAIAAAAMrbIpirHsclDrNfFIl1tNLW82XoK8C72GyF5oY5yKFTMAAAAPJC099p4rAKbRXUkmZZZwHysD7hwoRoIn7L7wypWXxMedIxxFQoTbbej78hPwBUf0AAAAC6rBgStf6x8M9KmvCOj7lPnx9ZufhqRDu19ygWzxU2h4R30woKU0o8BH2B9vCDlx8TyFgHoZgBMC1pYGANUVOt"}}

C:\Users\user\AppData\Roaming\Microsoft\Teams\Local State (copy)

Download File

Process:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	389
Entropy (8bit):	5.595102494251554
Encrypted:	false
SSDEEP:	6:YKWCRgXt9RdrtybHJXft3vkXeyzb/Pk+pMKx2Q/WKmo3xHJ2Wk3RdaNLzBmEcB58:YKWSg99rrt+pXtCB3kcx/p2WecfyqV
MD5:	59572E5CB2B9990005BA7054E027F7C8
SHA1:	2E1AD49AB545B4E1DBCBE8E8A0B649760805B749
SHA-256:	922B8A7A516BE5DA5C2C69A6E300C8592F4B8F0AE4F94DDA64DE7BDBE4415200
SHA-512:	6F8554E84DD5435D6849475D3C716747F3E43B074FB0639241798737AC80FF62A63963B1BCF3AB1D515BFE7FE1686E5EE8EF32249C5A43D22FADAE64FADB594D
Malicious:	false
Preview:	{"os_crypt":{"encrypted_key":"RFBBUEkBAAAA0Iyd3wEV0RGMegDAT8KX6wEAAACNX62TarVhQY6QpyLm8bPJAAAAAAIAAAAAABBmAAAAAQAAIAAAAHIu9hiUcsbh0j7EtNxWmZzY9aZId4uZfNtlWpW4QIo5AAAAAA6AAAAAAgAAIAAAAMrbIpirHsclDrNfFIl1tNLW82XoK8C72GyF5oY5yKFTMAAAAPJC099p4rAKbRXUkmZZZwHysD7hwoRoIn7L7wypWXxMedIxxFQoTbbej78hPwBUf0AAAAC6rBgStf6x8M9KmvCOj7lPnx9ZufhqRDu19ygWzxU2h4R30woKU0o8BH2B9vCDlx8TyFgHoZgBMC1pYGANUVOt"}}

C:\Users\user\AppData\Roaming\Microsoft\Teams\SquirrelTelemetry.log

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	ASCII text, with very long lines (1118), with CRLF line terminators
Category:	dropped
Size (bytes):	17819
Entropy (8bit):	5.230950910100598
Encrypted:	false
SSDEEP:	192:T8PmSEk8WmOk8jmHjymCe8MmLym50mTTmZzmZ4m51mIbmramEomxg+mlym8ume6u:IKePl0N
MD5:	CB29B9B06F0E4C9D367306985F00D2A1
SHA1:	8C3F6615A07820AD24D5B3A8E8392352CE2E5BC2
SHA-256:	F74FEA5A1C04B60215F4B041BEDBF064360587C0570508F8E85B7620DD2D4D9B
SHA-512:	8AA17AA6B6AF54457C0D7FB5308AD9DFE72E65591393B12C8D6FEBE4B37158215C738F8854DD16102D3755136D9777D5F612F17AB1A99F6E0D96C1D7A0853E09
Malicious:	false
Preview:	25/06/2024 15:03:44> DownloadUrlRetry: 0, endpointUrl: https://statics.teams.cdn.office.net/production-windows-x64/1.7.00.15969/RELEASES.exe, Scenario.Status: success, scenario: d9e29373-f14e-4079-8fb7-971577ce0d73, Scenario.Name: desktop_squirrel_stubinstall, Scenario.Step: download_file_start, sequence: 3, appversion: , platformId: 27, DeviceInfo.OsName: Windows, DeviceInfo.CpuArchitecture: x64, DeviceInfo.OsVersion: 10.0.19045.0, AppInfo.ProcessArchitecture: x86, AppInfo.ClientType: desktop, dllSearchPathState: unset, clientType: desktop, source: exe, distSrc: default, breadcrumb: dud;t1ib;gpcpc;inc;ejfpd;ums;ap;cuh;, SignedPackages: enabled, desktopSession: desktop-7c68a190-2550-4769-8a62-3e009f1829c5, installSessionId: fb32783498766d0541f091affba566b71b05571e77893fdd2d55d44d50e1e094, delta: 123963, scenarioDelta: 123963, elapsed: 1719342224034, stepDelta: 13296, DeviceInfo.ComputerUuid: 2ed9274289dcdd7292e8869fa5a66493, DeviceInfo.OfficeMachineId: b2df2e355e3c024991f286e19a95b9c3,

C:\Users\user\AppData\Roaming\Microsoft\Teams\teams_install_session.json

Download File

Process:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	105
Entropy (8bit):	4.729144061895501
Encrypted:	false
SSDEEP:	3:YTyLSMfTQg7dbGTjEUSN5TTHH7nieWdhmQRiG2Oovn:YWLSeTQg7hGkUSXTTHH7njmmsimy
MD5:	81BBEFA629E11DB0C33C5503B1860B25
SHA1:	B838AC5E4EE7B03CA2B506D7C66FE60426BF3F90
SHA-256:	650C44A154548EFA4E627D4228A451C54DAFD4A46DBA1C776DB4002EAE34D7E5
SHA-512:	C5AF8322F8DC05831F90DCFB4EA231A3C1CC307F4CE03318AA9FD867EA0CB63952A78DE5C12337BDE6E1F7892EC38CB527A3E7B080664A46B9A753F737723800
Malicious:	false
Preview:	{"version":"1.0","installSessionId":"fb32783498766d0541f091affba566b71b05571e77893fdd2d55d44d50e1e094"}..

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	6.372806598892005
TrID:	Win32 Executable (generic) a (10002005/4) 99.51% InstallShield setup (43055/19) 0.43% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02%
File name:	Teams.exe
File size:	2'010'032 bytes
MD5:	bc40d343632f54712a794d8b699925a9
SHA1:	103e982c4767c799894152e0a58a59d55971052c
SHA256:	0bb16506d1f5c422644435a7dafd379c96f136f4e68703a45266066694ede59e
SHA512:	69b47872835e218ebf4a5eaa4cdd55074e869a70c5667e0992e429cce052aadc3be46431b21b9212be05dbd21b8e7c63eddc4652012ee85a86b604317e9940a6
SSDEEP:	49152:SsjxBrEi/YB4ocuJ5txUJGvSEmrxlbTT1z658opmZ3qUieDJ3:SsjxBrEMYB4ocuEbr1WNy
TLSH:	CE956A11BB81C136C59092B0CC79E7ED6129BDA89F3142C772D87B6F6D315C21A31ABB
File Content Preview:	MZ......................@...................................0...........!..L.!This program cannot be run in DOS mode....$......................................................................................................................................

File Icon


Icon Hash:	4c4f64e46464070e

Static PE Info

General

Entrypoint:	0x48415f
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:
Time Stamp:	0x649ABCD0 [Tue Jun 27 10:41:20 2023 UTC]
TLS Callbacks:	0x491e70
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	1
File Version Major:	5
File Version Minor:	1
Subsystem Version Major:	5
Subsystem Version Minor:	1
Import Hash:	ce4e2fc5585de103fd4f6ad81c4bc8f0

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=GlobalSign GCC R45 EV CodeSigning CA 2020, O=GlobalSign nv-sa, C=BE
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	11/06/2024 11:51:20 12/06/2025 11:51:20
Subject Chain	CN="Changchun Bapco Technology Development Co., Ltd.", O="Changchun Bapco Technology Development Co., Ltd.", L=Changchun, S=Jilin, C=CN, OID.1.3.6.1.4.1.311.60.2.1.1=Changchun, OID.1.3.6.1.4.1.311.60.2.1.2=Jilin, OID.1.3.6.1.4.1.311.60.2.1.3=CN, SERIALNUMBER=91220105MA145FUX1P, OID.2.5.4.15=Private Organization
Version:	3
Thumbprint MD5:	071DFE1801F287417DFD91585FF6C1D8
Thumbprint SHA-1:	E03C2FF39F7E304C2737AEEB68182381277172B8
Thumbprint SHA-256:	4010F6BD3E1573534F4C47FD33A4B164AA1BC3E6EB5CA383D84FA78784A72F33
Serial:	646E606D30DF08F8C51ACBC1

Entrypoint Preview

Instruction
call 00007F2C549C4A39h
jmp 00007F2C549C422Fh
mov ecx, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], ecx
pop ecx
pop edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
push ecx
ret
mov ecx, dword ptr [ebp-10h]
xor ecx, ebp
call 00007F2C549C37B8h
jmp 00007F2C549C4390h
mov ecx, dword ptr [ebp-14h]
xor ecx, ebp
call 00007F2C549C37A7h
jmp 00007F2C549C437Fh
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0056B06Ch]
xor eax, ebp
push eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0056B06Ch]
xor eax, ebp
push eax
mov dword ptr [ebp-10h], eax
push dword ptr [ebp-04h]
mov dword ptr [ebp-04h], FFFFFFFFh
lea eax, dword ptr [ebp-0Ch]
mov dword ptr fs:[00000000h], eax
ret
push eax
push dword ptr fs:[00000000h]
lea eax, dword ptr [esp+0Ch]
sub esp, dword ptr [esp+0Ch]
push ebx
push esi
push edi
mov dword ptr [eax], ebp
mov ebp, eax
mov eax, dword ptr [0056B06Ch]

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x162a00	0x5e0c	.rdata
IMAGE_DIRECTORY_ENTRY_IMPORT	0x16880c	0x154	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x174000	0x67fb0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x1e8200	0x29b0	.reloc
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x1dc000	0xf7dc	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x14cfb0	0x70	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x14d020	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xe32e8	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0xe0000	0x5b4	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x16277c	0x60	.rdata
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0xde49b	0xde600	ea8fad7c993819557db985923137c510	False	0.47093148362844295	data	6.573286513315637	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0xe0000	0x8a810	0x8aa00	f7c2aefd1e981c311fc801b37d3acffb	False	0.24187577490982867	data	4.330852099926778	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x16b000	0x8c98	0x7600	d9c27677e922321dfe7188bb56bf02cf	False	0.162109375	DOS executable (block device driver pyright)	4.919274993295812	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x174000	0x67fb0	0x68000	8bec53f80d6da13a4338d191a121580f	False	0.6052199143629807	data	6.870365584614006	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.reloc	0x1dc000	0xf7dc	0xf800	cde0b1c03377eac8fb0878ceee8e0fcd	False	0.5842993951612904	data	6.554531087200709	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
	0x174600	0x22800	data			0.8473873414855072
RT_ICON	0x196e00	0x2e8	Device independent bitmap graphic, 32 x 64 x 4, image size 512			0.3064516129032258
RT_ICON	0x1970e8	0x128	Device independent bitmap graphic, 16 x 32 x 4, image size 128			0.48986486486486486
RT_ICON	0x197210	0x1628	Device independent bitmap graphic, 64 x 128 x 8, image size 4096, 256 important colors			0.24876586741889986
RT_ICON	0x198838	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 2304, 256 important colors			0.298773987206823
RT_ICON	0x1996e0	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 1024, 256 important colors			0.1565884476534296
RT_ICON	0x199f88	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 256, 256 important colors			0.16329479768786126
RT_ICON	0x19a4f0	0x3524	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced			0.9886062922669803
RT_ICON	0x19da14	0x94a8	Device independent bitmap graphic, 96 x 192 x 32, image size 38016			0.10857683413916334
RT_ICON	0x1a6ebc	0x67e8	Device independent bitmap graphic, 80 x 160 x 32, image size 26560			0.11736842105263158
RT_ICON	0x1ad6a4	0x5488	Device independent bitmap graphic, 72 x 144 x 32, image size 21600			0.1307301293900185
RT_ICON	0x1b2b2c	0x4228	Device independent bitmap graphic, 64 x 128 x 32, image size 16896			0.1379900803023146
RT_ICON	0x1b6d54	0x3a48	Device independent bitmap graphic, 60 x 120 x 32, image size 14880			0.14711796246648792
RT_ICON	0x1ba79c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 9600			0.18443983402489628
RT_ICON	0x1bcd44	0x1a68	Device independent bitmap graphic, 40 x 80 x 32, image size 6720			0.20310650887573964
RT_ICON	0x1be7ac	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4224			0.08864915572232646
RT_ICON	0x1bf854	0x988	Device independent bitmap graphic, 24 x 48 x 32, image size 2400			0.125
RT_ICON	0x1c01dc	0x6b8	Device independent bitmap graphic, 20 x 40 x 32, image size 1680			0.13895348837209304
RT_ICON	0x1c0894	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 1088			0.17819148936170212
RT_RCDATA	0x1c0cfc	0xca2	PNG image data, 48 x 48, 8-bit/color RGBA, interlaced			1.0034013605442176
RT_RCDATA	0x1c19a0	0x13a5	PNG image data, 326 x 135, 8-bit/color RGBA, non-interlaced			0.887651620600517
RT_RCDATA	0x1c2d48	0x1277	PNG image data, 326 x 135, 8-bit/color RGBA, non-interlaced			0.8811085254918553
RT_RCDATA	0x1c3fc0	0x5936	PNG image data, 563 x 450, 8-bit/color RGBA, non-interlaced			0.8779227603117611
RT_RCDATA	0x1c98f8	0xe080	PNG image data, 563 x 450, 8-bit/color RGBA, non-interlaced			0.9845663975501113
RT_RCDATA	0x1d7978	0x3c66	PNG image data, 563 x 450, 8-bit/color RGBA, non-interlaced			0.8778941922131678
RT_GROUP_ICON	0x1db5e0	0x102	data			0.6317829457364341
RT_VERSION	0x1db6e4	0x354	data	English	United States	0.4448356807511737
RT_MANIFEST	0x1dba38	0x576	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1338), with CRLF line terminators	English	United States	0.4427753934191702

Imports

DLL	Import
KERNEL32.dll	DeleteCriticalSection, GetProcessHeap, GetModuleFileNameW, GetCurrentThreadId, GetCurrentProcess, EnterCriticalSection, LeaveCriticalSection, InitializeCriticalSection, SetUnhandledExceptionFilter, VerSetConditionMask, VerifyVersionInfoW, GetVersionExW, GetNativeSystemInfo, GetModuleHandleW, CreateMutexW, GetSystemTimeAsFileTime, GetComputerNameW, FreeResource, LockResource, LoadResource, SizeofResource, FindResourceW, GetTempPathW, GlobalAlloc, GlobalLock, GlobalUnlock, GlobalFree, FormatMessageW, LocalFree, Process32FirstW, Process32NextW, OpenProcess, CreateToolhelp32Snapshot, WaitForSingleObject, CreateEventW, SetEvent, ResetEvent, SetWaitableTimer, ReleaseMutex, GetExitCodeThread, SetLastError, InterlockedExchange, InterlockedDecrement, InterlockedIncrement, GetExitCodeProcess, TerminateProcess, CreateProcessW, GetCommandLineW, FindResourceExW, GetUserDefaultUILanguage, CreateDirectoryW, RemoveDirectoryW, UnlockFile, LockFile, QueryPerformanceCounter, MulDiv, lstrlenW, CompareStringW, GlobalReAlloc, lstrcmpiW, LoadLibraryExW, Sleep, lstrcmpW, WriteConsoleW, SetStdHandle, SetEnvironmentVariableW, SetEnvironmentVariableA, FreeEnvironmentStringsW, GetEnvironmentStringsW, DecodePointer, GetOEMCP, IsValidCodePage, FindFirstFileExW, GetTimeZoneInformation, ReadConsoleW, EnumSystemLocalesW, IsValidLocale, GetTimeFormatW, GetDateFormatW, GetConsoleMode, GetConsoleCP, ExitProcess, QueryPerformanceFrequency, GetModuleHandleExW, FreeLibraryAndExitThread, ExitThread, CreateThread, SetConsoleCtrlHandler, RtlUnwind, GetUserDefaultLCID, GetStringTypeExW, LoadLibraryA, GetFileType, GetStdHandle, VirtualFree, VirtualAlloc, FlushInstructionCache, InterlockedPushEntrySList, InterlockedPopEntrySList, OutputDebugStringW, SystemTimeToFileTime, CreateWaitableTimerA, OpenEventA, CreateEventA, WaitForMultipleObjectsEx, FormatMessageA, AreFileApisANSI, DeviceIoControl, SetFilePointerEx, SetEndOfFile, GetEnvironmentVariableW, GetStartupInfoW, IsDebuggerPresent, IsProcessorFeaturePresent, UnhandledExceptionFilter, InitializeSListHead, WaitForSingleObjectEx, GetCPInfo, GetLocaleInfoW, LCMapStringW, EncodePointer, TlsFree, TlsSetValue, TlsGetValue, TlsAlloc, SwitchToThread, GetStringTypeW, LoadLibraryExA, VirtualQuery, VirtualProtect, GetSystemInfo, HeapAlloc, RaiseException, HeapReAlloc, HeapSize, InitializeCriticalSectionAndSpinCount, HeapFree, MultiByteToWideChar, GetACP, WideCharToMultiByte, ReadFile, FindClose, HeapDestroy, FindNextFileW, FindFirstFileW, WriteFile, SetFilePointer, FlushFileBuffers, GetFileSize, GetFileAttributesW, MoveFileW, GetLocalTime, GetCurrentProcessId, GetModuleHandleA, LoadLibraryW, GetLastError, SetErrorMode, FreeLibrary, CreateFileW, DeleteFileW, CloseHandle, GetTickCount, GetProcAddress, GetCommandLineA
USER32.dll	IsChild, UnregisterClassW, RegisterWindowMessageW, GetClassNameW, RedrawWindow, GetMessageW, TranslateMessage, DispatchMessageW, SystemParametersInfoW, GetSysColor, GetSystemMetrics, ShowWindow, SetForegroundWindow, IsWindow, GetActiveWindow, WaitForInputIdle, MessageBoxW, SendMessageW, GetDC, ReleaseDC, SetWindowLongW, GetWindowLongW, DefWindowProcW, CallWindowProcW, LoadStringW, OffsetRect, UnionRect, SetWindowTextW, InvalidateRect, BeginPaint, EndPaint, GetClientRect, PtInRect, ScreenToClient, GetFocus, DrawFocusRect, ClientToScreen, GetParent, LoadImageW, FillRect, GetSysColorBrush, SetCapture, GetWindowTextW, CreateAcceleratorTableW, InvalidateRgn, GetDesktopWindow, DestroyAcceleratorTable, PeekMessageW, CharNextW, MapDialogRect, DialogBoxIndirectParamW, EndDialog, GetWindowTextLengthW, DrawTextW, DeleteMenu, GetDlgItem, DestroyCursor, LoadCursorW, GetClassInfoExW, RegisterClassExW, CreateDialogIndirectParamW, GetSystemMenu, EnableMenuItem, SetFocus, GetWindow, MonitorFromWindow, GetMonitorInfoW, GetWindowRect, MapWindowPoints, DestroyWindow, IsDialogMessageW, PostQuitMessage, GetCursorPos, GetCursor, ReleaseCapture, GetCapture, SetCursor, CreateWindowExW, SetTimer, AdjustWindowRectEx, GetMenu, KillTimer, SetWindowPos, PostMessageW, MoveWindow
GDI32.dll	SetTextColor, DeleteDC, DeleteObject, GetObjectW, SetBkMode, SelectObject, GetDeviceCaps, CreateSolidBrush, CreateCompatibleBitmap, CreateCompatibleDC, BitBlt, CreateFontIndirectW, GetStockObject, SetWindowOrgEx, GetCurrentObject, SetViewportOrgEx
SHELL32.dll	ShellExecuteExW, CommandLineToArgvW, ShellExecuteW, SHBrowseForFolderW, SHGetFolderPathW, SHGetPathFromIDListW
ole32.dll	CLSIDFromProgID, CoGetClassObject, OleLockRunning, CoTaskMemAlloc, CoTaskMemRealloc, CreateStreamOnHGlobal, CLSIDFromString, StringFromGUID2, CoUninitialize, CoInitializeEx, OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateGuid, CoCreateInstance
OLEAUT32.dll	SysAllocStringLen, LoadTypeLib, LoadRegTypeLib, OleCreateFontIndirect, VarUI4FromStr, VariantInit, SysStringLen, VariantClear, SysFreeString, SysAllocString
SHLWAPI.dll	PathFileExistsW, PathFindFileNameW
COMCTL32.dll	InitCommonControlsEx
UxTheme.dll	GetThemeFont, OpenThemeData, GetThemeColor
PSAPI.DLL	GetModuleFileNameExW
gdiplus.dll	GdipDeleteBrush, GdipCreateSolidFill, GdipCreateFromHDC, GdipDrawImageRectI, GdipSetInterpolationMode, GdipGetImageGraphicsContext, GdipDisposeImage, GdipCreateBitmapFromScan0, GdipGetImageWidth, GdipGetImageHeight, GdipCloneImage, GdipAlloc, GdipFree, GdipLoadImageFromStream, GdipFillRectangleI, GdiplusStartup, GdiplusShutdown, GdipDeleteGraphics
RPCRT4.dll	UuidCreate
VERSION.dll	GetFileVersionInfoSizeW, VerQueryValueW, GetFileVersionInfoW
WINHTTP.dll	WinHttpConnect, WinHttpOpen, WinHttpCloseHandle, WinHttpSetTimeouts, WinHttpQueryOption, WinHttpQueryHeaders, WinHttpReadData, WinHttpQueryDataAvailable, WinHttpOpenRequest, WinHttpSetOption, WinHttpSendRequest, WinHttpSetStatusCallback, WinHttpReceiveResponse, WinHttpCrackUrl
CRYPT32.dll	CertFreeCertificateContext, CertGetCertificateChain, CertCreateCertificateChainEngine, CertNameToStrW, CertFreeCertificateChainEngine, CertFreeCertificateChain, CryptProtectData
WINTRUST.dll	WinVerifyTrust

Exports

Name	Ordinal	Address
?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@34@XZ@4HA	1	0x5739f0
?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@34@XZ@4HA	2	0x573a80
?$TSS0@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@34@XZ@4HA	3	0x573a8c
?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4HA	4	0x5739f4
?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4HA	5	0x573a20
?$TSS0@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4HA	6	0x573a0c
?$TSS0@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4HA	7	0x572d28
?$TSS0@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4HA	8	0x572d3c
?$TSS0@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4HA	9	0x572d64
?$TSS0@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4HA	10	0x572d50
?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4HA	11	0x573a3c
?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4HA	12	0x573a88
?$TSS0@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4HA	13	0x573a9c
??0?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@QAE@XZ	14	0x41beb0
??0?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@QAE@XZ	15	0x41b620
??0?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@QAE@XZ	16	0x416a10
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@XZ	17	0x41bee0
?get_const_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@XZ	18	0x41b650
?get_const_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@SAABV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@XZ	19	0x416a40
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ	20	0x41c1d0
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ	21	0x41b830
?get_const_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ	22	0x416d80
?get_const_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ	23	0x48b240
?get_const_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAABV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ	24	0x48c100
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ	25	0x48f240
?get_const_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAABV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ	26	0x48ec00
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ	27	0x41bdd0
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ	28	0x41b540
?get_const_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@SAABV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ	29	0x416900
?get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@XZ	30	0x41bf90
?get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@XZ	31	0x41b6e0
?get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@XZ	32	0x416b40
?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ	33	0x41c210
?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ	34	0x41b870
?get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ	35	0x416dc0
?get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ	36	0x48b250
?get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ	37	0x48c110
?get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ	38	0x48f250
?get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ	39	0x48ec10
?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@XZ	40	0x41be10
?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@XZ	41	0x41b580
?get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@XZ	42	0x416970
?get_mutable_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@XZ	43	0x48b330
?get_mutable_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@XZ	44	0x48c1f0
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ	45	0x48f330
?get_mutable_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ	46	0x48ecf0
?instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@23@A	47	0x573a40
?instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@23@A	48	0x5739f8
?instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@0AAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@23@A	49	0x573a84
?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@A	50	0x573a58
?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@A	51	0x573aa4
?instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@A	52	0x5739c8
?instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@3@A	53	0x572d18
?instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@0AAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@3@A	54	0x572d2c
?instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@A	55	0x572d54
?instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@0AAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@A	56	0x572d40
?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@3@A	57	0x5739d8
?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@3@A	58	0x573a70
?instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@0AAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@3@A	59	0x573a28
?is_destroyed@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ	60	0x48b4f0
?is_destroyed@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@SA_NXZ	61	0x48c340
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ	62	0x48f360
?is_destroyed@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@SA_NXZ	63	0x48ed20
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z	64	0x41c2b0
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z	65	0x41b910
?load_object_data@?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@UBEXAAVbasic_iarchive@234@PAXI@Z	66	0x416e60
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z	67	0x41c050
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z	68	0x41b7a0
?save_object_data@?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@UBEXAAVbasic_oarchive@234@PBX@Z	69	0x416c00
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Uactivity_item@core_utils@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@Uactivity_item@core_utils@@@serialization@boost@@@detail@34@A	70	0x573a5c
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@serialization@boost@@@detail@34@A	71	0x573a44
?t@?1??get_instance@?$singleton@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@serialization@boost@@CAAAV?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@34@XZ@4V?$singleton_wrapper@V?$extended_type_info_typeid@Vtelemetry_chunk@core_utils@@@serialization@boost@@@detail@34@A	72	0x5739dc
?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@634@A	73	0x573a14
?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std	74	0x573a74
?t@?1??get_instance@?$singleton@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$iserializer@Vtext_iarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@634@A	75	0x573a90
?t@?1??get_instance@?$singleton@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_iarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A	76	0x572d20
?t@?1??get_instance@?$singleton@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@serialization@boost@@CAAAV?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@4@XZ@4V?$singleton_wrapper@V?$map@Vtext_oarchive@archive@boost@@@extra_detail@detail@archive@boost@@@734@A	77	0x572d34
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info@serialization@boost@@Ukey_compare@detail@23@V?$allocator@PBVextended_type_info@serialization@boost@@@st	78	0x572d5c
?t@?1??get_instance@?$singleton@V?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@@serialization@boost@@CAAAV?$multiset@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@Utype_compare@234@V?$allocator@PBVextended_type_info_typeid_0@typeid_system@serialization@boost@@@std@@@std@@XZ@4V?$singleton_wrapper@V?$multiset@PBVextended_type_info_typeid_0@typeid_syste	79	0x572d48
?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@Uactivity_item@core_utils@@@detail@archive@boost@@@634@A	80	0x5739fc
?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std@@@std@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@V?$list@Uactivity_item@core_utils@@V?$allocator@Uactivity_item@core_utils@@@std	81	0x573a2c
?t@?1??get_instance@?$singleton@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@serialization@boost@@CAAAV?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@4@XZ@4V?$singleton_wrapper@V?$oserializer@Vtext_oarchive@archive@boost@@Vtelemetry_chunk@core_utils@@@detail@archive@boost@@@634@A	82	0x5739cc

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Target ID:	0
Start time:	15:01:13
Start date:	25/06/2024
Path:	C:\Users\user\Desktop\Teams.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Teams.exe"
Imagebase:	0x400000
File size:	2'010'032 bytes
MD5 hash:	BC40D343632F54712A794D8B699925A9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000000.00000003.2072126447.0000000000872000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:01:22
Start date:	25/06/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\schtasks.exe" /create /sc ONLOGON /tn "CSCOClient" /tr "C:\Users\user\AppData\Roaming\CSCOClient\client32.exe" /RL HIGHEST
Imagebase:	0xab0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:01:22
Start date:	25/06/2024
Path:	C:\Users\user\AppData\Roaming\CSCOClient\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\CSCOClient\client32.exe
Imagebase:	0x400000
File size:	55'456 bytes
MD5 hash:	9497AECE91E1CCC495CA26AE284600B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: C:\Users\user\AppData\Roaming\CSCOClient\client32.exe, Author: Joe Security
Reputation:	moderate
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	15:01:22
Start date:	25/06/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:01:24
Start date:	25/06/2024
Path:	C:\ProgramData\MSTeamsSetup_c_l_.exe
Wow64 process (32bit):	true
Commandline:	C:\ProgramData\MSTeamsSetup_c_l_.exe
Imagebase:	0x50000
File size:	1'447'792 bytes
MD5 hash:	CF0E0F57B68A11D099EC944200A6069D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:01:24
Start date:	25/06/2024
Path:	C:\ProgramData\MSTeamsSetup_c_l_.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\MSTeamsSetup_c_l_.exe" --rerunningWithoutUAC
Imagebase:	0x50000
File size:	1'447'792 bytes
MD5 hash:	CF0E0F57B68A11D099EC944200A6069D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:01:24
Start date:	25/06/2024
Path:	C:\Users\user\AppData\Roaming\CSCOClient\client32.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\CSCOClient\client32.exe
Imagebase:	0x400000
File size:	55'456 bytes
MD5 hash:	9497AECE91E1CCC495CA26AE284600B9
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Keylogger_Generic, Description: Yara detected Keylogger Generic, Source: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmp, Author: Joe Security Rule: JoeSecurity_NetSupport, Description: Yara detected NetSupport remote tool, Source: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmp, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:01:25
Start date:	25/06/2024
Path:	C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\SquirrelTemp\Update.exe" --install . --rerunningWithoutUAC --exeName=MSTeamsSetup_c_l_.exe --bootstrapperMode
Imagebase:	0x690000
File size:	2'587'536 bytes
MD5 hash:	8F0E958D7EF57D727ADCDA1C67C24C2B
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\SquirrelTemp\Update.exe, Author: Joe Security
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:03:29
Start date:	25/06/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe" --updateSelf=C:\Users\user\AppData\Local\SquirrelTemp\Update.exe
Imagebase:	0xb30000
File size:	2'593'968 bytes
MD5 hash:	17927E3240D3B0212A4B93C1D45F92B0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Microsoft\Teams\current\Squirrel.exe, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:03:30
Start date:	25/06/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-install 1.7.00.15969
Imagebase:	0x7ff6f62a0000
File size:	149'481'432 bytes
MD5 hash:	E20A8E5630CFCAD496816E211D212EAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	14
Start time:	15:03:33
Start date:	25/06/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --squirrel-firstrun
Imagebase:	0x7ff6f62a0000
File size:	149'481'432 bytes
MD5 hash:	E20A8E5630CFCAD496816E211D212EAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	16
Start time:	15:03:38
Start date:	25/06/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\system32\regsvr32.exe" /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll"
Imagebase:	0x3c0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:03:38
Start date:	25/06/2024
Path:	C:\Windows\System32\regsvr32.exe
Wow64 process (32bit):	false
Commandline:	/s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Teams.AddinLoader.dll"
Imagebase:	0x7ff64cbc0000
File size:	25'088 bytes
MD5 hash:	B0C2FA35D14A9FAD919E99D9D75E1B9E
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:03:38
Start date:	25/06/2024
Path:	C:\Windows\SysWOW64\regsvr32.exe
Wow64 process (32bit):	true
Commandline:	"C:\Windows\SysWOW64\regsvr32.exe" /s /n /i:user "C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x86\Microsoft.Teams.AddinLoader.dll"
Imagebase:	0x3c0000
File size:	20'992 bytes
MD5 hash:	878E47C8656E53AE8A8A21E927C6F7E0
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:03:44
Start date:	25/06/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=gpu-process --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --gpu-preferences=UAAAAAAAAADgAAAYAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEgAAAAAAAAASAAAAAAAAAAYAAAAAgAAABAAAAAAAAAAGAAAAAAAAAAQAAAAAAAAAAAAAAAOAAAAEAAAAAAAAAABAAAADgAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1724 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:2
Imagebase:	0x7ff6f62a0000
File size:	149'481'432 bytes
MD5 hash:	E20A8E5630CFCAD496816E211D212EAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Target ID:	20
Start time:	15:03:47
Start date:	25/06/2024
Path:	C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Microsoft\Teams\current\Teams.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --user-data-dir="C:\Users\user\AppData\Roaming\Microsoft\Teams" --mojo-platform-channel-handle=2144 --field-trial-handle=1880,i,2722608120260481919,6726150612852570996,131072 --disable-features=SpareRendererForSitePerProcess,WinRetrieveSuggestionsOnlyOnDemand /prefetch:8
Imagebase:	0x7ff6f62a0000
File size:	149'481'432 bytes
MD5 hash:	E20A8E5630CFCAD496816E211D212EAC
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.5%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	42.2%
Total number of Nodes:	400
Total number of Limit Nodes:	9

Executed Functions

Function 0005E7E8 Relevance: 49.2, APIs: 11, Strings: 17, Instructions: 241
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LoadLibraryW.KERNEL32(kernel32.dll,?), ref: 0005E827
GetProcAddress.KERNEL32(00000000,SetDefaultDllDirectories), ref: 0005E841
CoUninitialize.OLE32(?), ref: 0005EB2C

Strings

--checkInstall, xrefs: 0005E876
ERROR: please re-run this installer as a normal user instead of "Run as Administrator"., xrefs: 0005E983
Failed to install the .NET Framework, try installing .NET 4.5 or higher manually, xrefs: 0005E9D9
ERROR: this program cannot run on Windows XP or before; it requires a later version of Windows., xrefs: 0005E9B8
--rerunningWithoutUAC, xrefs: 0005E923
kernel32.dll, xrefs: 0005E822
Please re-run this installer as a normal user instead of "Run as Administrator"., xrefs: 0005E95E
This program cannot run on Windows XP or before; it requires a later version of Windows., xrefs: 0005E9A7
ERROR: failed to install the .NET Framework, try installing .NET 4.5 or higher manually, xrefs: 0005E9FE
--msiOverride, xrefs: 0005E8A6, 0005E8AB, 0005E8B2
Cannot install for all users when a VDI environment is not detected., xrefs: 0005EA24
SetDefaultDllDirectories, xrefs: 0005E83B
Incompatible Operating System, xrefs: 0005E9A2
--silent, xrefs: 0005E8C0, 0005E8C5, 0005E8CC
--allUsers, xrefs: 0005E93B
ERROR: cannot install for all users when a VDI environment is not detected., xrefs: 0005EA2E
--rerunningWithoutUAC, xrefs: 0005EA5E, 0005EA63, 0005EA6A

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: AddressLibraryLoadProcUninitialize
String ID: --msiOverride$ --rerunningWithoutUAC$ --silent$--allUsers$--checkInstall$--rerunningWithoutUAC$Cannot install for all users when a VDI environment is not detected.$ERROR: cannot install for all users when a VDI environment is not detected.$ERROR: failed to install the .NET Framework, try installing .NET 4.5 or higher manually$ERROR: please re-run this installer as a normal user instead of "Run as Administrator".$ERROR: this program cannot run on Windows XP or before; it requires a later version of Windows.$Failed to install the .NET Framework, try installing .NET 4.5 or higher manually$Incompatible Operating System$Please re-run this installer as a normal user instead of "Run as Administrator".$SetDefaultDllDirectories$This program cannot run on Windows XP or before; it requires a later version of Windows.$kernel32.dll
API String ID: 597072948-4182713384
Opcode ID: 9ec3147c662323037fefe1d7f2b98ebc67fb74ac94ae1093d77ffcfbcf4ef2f7
Instruction ID: e1d184b5942b89730e14aa7458be12168acd88cc06a496c59a1591a1fee38679
Opcode Fuzzy Hash: 9ec3147c662323037fefe1d7f2b98ebc67fb74ac94ae1093d77ffcfbcf4ef2f7
Instruction Fuzzy Hash: A981E2315083819BDB69AB30D806BEF77E4AF91752F040868FDC697192DF369A0CD792

Function 00056777 Relevance: 26.6, APIs: 12, Strings: 3, Instructions: 359
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00056781

Part of subcall function 000566D0: __EH_prolog3_GS.LIBCMT ref: 000566D7
Part of subcall function 000566D0: IUnknown_QueryInterface_Proxy.RPCRT4 ref: 00056735

IUnknown_QueryInterface_Proxy.RPCRT4 ref: 00056866
SysFreeString.OLEAUT32(?), ref: 000568D5
VariantClear.OLEAUT32(?), ref: 000568FD
VariantClear.OLEAUT32(?), ref: 0005690A
VariantClear.OLEAUT32(?), ref: 00056917
VariantClear.OLEAUT32(?), ref: 00056921
SysAllocString.OLEAUT32(?), ref: 00056966
SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00056A7D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00056AA0

Part of subcall function 00059372: VariantClear.OLEAUT32 ref: 0005937E
Part of subcall function 00059372: SysAllocString.OLEAUT32(?), ref: 00059391
Part of subcall function 00059372: VariantClear.OLEAUT32 ref: 000593C2

GetLastError.KERNEL32 ref: 00056AAE

Strings

\SquirrelTemp, xrefs: 00056A83
Unable to write to %s - IT policies may be restricting access to this folder, xrefs: 00056AD8
PF, xrefs: 000567E7

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ClearVariant$String$AllocH_prolog3_Interface_ProxyQueryUnknown_$CreateDirectoryErrorFolderFreeLastPath
String ID: PF$Unable to write to %s - IT policies may be restricting access to this folder$\SquirrelTemp
API String ID: 180059506-414888272
Opcode ID: 23cf153eff521859edad7423bd0c617528e5a9324a6056d5f6886d3675ad5085
Instruction ID: 397cca6712c14c2c739e542d81ca5d11d26eb293f13901f178d97495e58b3a6f
Opcode Fuzzy Hash: 23cf153eff521859edad7423bd0c617528e5a9324a6056d5f6886d3675ad5085
Instruction Fuzzy Hash: CAD1AD71D00628DFDB11DFA8CC44ADEBBB9AF09311F1441A9E849BB281DB765E84CF91

Function 00056509 Relevance: 9.2, APIs: 6, Instructions: 167
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00056510
CoCreateInstance.OLE32(000869B0,00000000,00000017,000965B0,?,00000044,000566EE,0000000C,0005679C,0000009C,0005EA96,?,00000000, --rerunningWithoutUAC), ref: 00056530
VariantInit.OLEAUT32(?), ref: 0005654D
IUnknown_QueryInterface_Proxy.RPCRT4 ref: 000565B2
VariantClear.OLEAUT32(?), ref: 0005669D
VariantClear.OLEAUT32(?), ref: 000566A7

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: Variant$Clear$CreateH_prolog3_InitInstanceInterface_ProxyQueryUnknown_
String ID:
API String ID: 897443949-0
Opcode ID: 06f0617af185965e8b290ee600c7f646c3f36215de7ee6a3baf868dcde3573fa
Instruction ID: 06f8b3d2feb67fec7869adefd8aa70307d31aa7d4dcebf02a0b8d1c0a259d37c
Opcode Fuzzy Hash: 06f0617af185965e8b290ee600c7f646c3f36215de7ee6a3baf868dcde3573fa
Instruction Fuzzy Hash: 0351B471A00618DFDF44DFA4CC54B9EBBB9BF48311F154098E946EB2A0CB7AAD05CB50

Function 00070CC3 Relevance: 4.5, APIs: 3, Instructions: 20
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32(0006EC55,?,00070C99,0006EC55,0009A6B0,0000000C,00070DF0,0006EC55,00000002,00000000,?,0006EC55), ref: 00070CE4
TerminateProcess.KERNEL32(00000000,?,00070C99,0006EC55,0009A6B0,0000000C,00070DF0,0006EC55,00000002,00000000,?,0006EC55), ref: 00070CEB
ExitProcess.KERNEL32 ref: 00070CFD

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: Process$CurrentExitTerminate
String ID:
API String ID: 1703294689-0
Opcode ID: 67e47cda2b364345773cfba8c0b6b676ad1c5ea866bccaf1c1339277f01000d9
Instruction ID: 9d3d3bc7d84be8020797908aae7c45fc079f1f919cc0a9904c62f67122537eaf
Opcode Fuzzy Hash: 67e47cda2b364345773cfba8c0b6b676ad1c5ea866bccaf1c1339277f01000d9
Instruction Fuzzy Hash: 89E04632440248EBDF526F54CD08A883B6AFF00382F018110FC498A223CB7EED42DB85

Function 00056487 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentProcess.KERNEL32 ref: 00056498
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 000564A9
GetLastError.KERNEL32 ref: 000564B3
GetTokenInformation.KERNELBASE(00000000,00000012(TokenIntegrityLevel),?,00000004,?), ref: 000564D8
CloseHandle.KERNEL32(00000000), ref: 000564F4

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ProcessToken$CloseCurrentErrorHandleInformationLastOpen
String ID:
API String ID: 2078281146-0
Opcode ID: dbe2fab5cf3ad17c3eee0e3221529b1b2991181a3b25609433c743e1d51ee40f
Instruction ID: 39cfa1c068a866eea7c365eb00d5dc47fd0948364b6124310bb55d2c46e1a08a
Opcode Fuzzy Hash: dbe2fab5cf3ad17c3eee0e3221529b1b2991181a3b25609433c743e1d51ee40f
Instruction Fuzzy Hash: 2D015230A00209EFEB10DFA0CD49BBFB7B8BB04702F404428A942D2191DB7A9908DF51

Function 00051220 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegQueryValueExW.KERNELBASE(?,Release,00000000,?,?,?,80000002,SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full,00020019), ref: 00051276

Strings

Release, xrefs: 0005126E
SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full, xrefs: 0005123B

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: QueryValue
String ID: Release$SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full
API String ID: 3660427363-1765340461
Opcode ID: f8afdd9e397617ad1d5211984402d32abf4c88e5f2d1cf67cc9cd8c7b1bdf04a
Instruction ID: bd316b81801a1f7b1ca8c2076411e40ba08dd6295dec7c0150a556295a658af2
Opcode Fuzzy Hash: f8afdd9e397617ad1d5211984402d32abf4c88e5f2d1cf67cc9cd8c7b1bdf04a
Instruction Fuzzy Hash: 8001ED70E0030DAEEF00DF95C885AFFBBB8AB15349F50446AD911E6281E7749A58DF50

Function 000566D0 Relevance: 3.1, APIs: 2, Instructions: 59
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 000566D7

Part of subcall function 00056509: __EH_prolog3_GS.LIBCMT ref: 00056510
Part of subcall function 00056509: CoCreateInstance.OLE32(000869B0,00000000,00000017,000965B0,?,00000044,000566EE,0000000C,0005679C,0000009C,0005EA96,?,00000000, --rerunningWithoutUAC), ref: 00056530
Part of subcall function 00056509: VariantInit.OLEAUT32(?), ref: 0005654D
Part of subcall function 00056509: IUnknown_QueryInterface_Proxy.RPCRT4 ref: 000565B2

IUnknown_QueryInterface_Proxy.RPCRT4 ref: 00056735

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: H_prolog3_Interface_ProxyQueryUnknown_$CreateInitInstanceVariant
String ID:
API String ID: 3581078782-0
Opcode ID: 3b9e67dc88c89d95e565c286dd024d5425059a13e4202c36342c08081bf8ed0f
Instruction ID: dc09a55126a2df3721bf17da1bfd5d5373b15de466b64639f8d34310c2f0ed7d
Opcode Fuzzy Hash: 3b9e67dc88c89d95e565c286dd024d5425059a13e4202c36342c08081bf8ed0f
Instruction Fuzzy Hash: 0911E931600A09CFDB00DB54C855B6F77B6BF88311F150198E502EB3A0DF76AE01CB90

Function 00052320 Relevance: 1.6, APIs: 1, Instructions: 51
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,80000002,00000000,?,?,?,?,?,00051253,80000002,SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full), ref: 00052362

Part of subcall function 000522B1: GetModuleHandleW.KERNEL32(Advapi32.dll,?,80000002,00000000,?,00052354,00000000,?,?,80000002,00000000,?,?,?,?), ref: 000522C4
Part of subcall function 000522B1: GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 000522D4

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: AddressHandleModuleOpenProc
String ID:
API String ID: 1337834000-0
Opcode ID: 99c091aa13b013b3800f2fa5d5fa90e0e39d95da6bc6a7c561be27863bfdbd9e
Instruction ID: cd8b87a73166294ff27e924112dfd806baef2a2ab172808fa52caddc40ea831d
Opcode Fuzzy Hash: 99c091aa13b013b3800f2fa5d5fa90e0e39d95da6bc6a7c561be27863bfdbd9e
Instruction Fuzzy Hash: 0201407161121ABBDB08CF55C855EEFBBA9EF49711F00411DB805A7240DB78AE048B94

Non-executed Functions

Function 00056982 Relevance: 81.2, APIs: 29, Strings: 17, Instructions: 721
fileprocesssynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 00056A7D
CreateDirectoryW.KERNEL32(?,00000000), ref: 00056AA0
GetLastError.KERNEL32 ref: 00056AAE
SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00056B45
GetUserNameW.ADVAPI32(?,00000200), ref: 00056B59
GetLastError.KERNEL32 ref: 00056B5F
CreateDirectoryW.KERNEL32(?,00000000), ref: 00056B90
GetLastError.KERNEL32 ref: 00056B9E
FindResourceW.KERNEL32(00000083,DATA), ref: 00056D21
LoadResource.KERNEL32(00000000), ref: 00056D3E
SizeofResource.KERNEL32(00000000), ref: 00056D62
LockResource.KERNEL32(00000000), ref: 00056D77
DeleteFileW.KERNEL32(?), ref: 00056E49
FreeResource.KERNEL32(00000000), ref: 00056F04
GetFileAttributesW.KERNEL32(?), ref: 00056F48
GetModuleHandleW.KERNEL32(00000000), ref: 00056F58
GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00056F6B
PathFileExistsW.SHLWAPI(?,?,%s\%s,?,setup.json,00000000,?,00000000,00000000,?,?,?,?), ref: 000570D1
CopyFileW.KERNEL32(?,?,00000000), ref: 000570EA
FindFirstFileW.KERNEL32(?,?), ref: 00057171
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,?), ref: 0005717E
FindClose.KERNEL32(00000000), ref: 0005719E
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000000,00000000,?,?,?), ref: 00057236
WaitForSingleObject.KERNEL32(?,00094650), ref: 0005724E
GetExitCodeProcess.KERNEL32(?,?), ref: 00057261
DeleteFileW.KERNEL32(?), ref: 000572D2
CloseHandle.KERNEL32(?), ref: 000572F4
CloseHandle.KERNEL32(?), ref: 00057300

Part of subcall function 000563D0: GetActiveWindow.USER32 ref: 0005644E
Part of subcall function 000563D0: ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000005), ref: 00056472

Part of subcall function 00059D9D: __EH_prolog3_GS.LIBCMT ref: 00059DA7
Part of subcall function 00059D9D: _strftime.LIBCMT ref: 00059DE2

FreeResource.KERNEL32(00000000), ref: 00057418

Strings

%s\SquirrelSetup.log, xrefs: 00056D03
ERROR: failed to extract installer, xrefs: 00057395
D, xrefs: 000571AA
Failed to extract installer, xrefs: 0005736B
Unable to write to %s - IT policies may be restricting access to this folder, xrefs: 00056AD8, 00056BC4
ERROR: there was an error while installing the application (see above), xrefs: 000572B0
%s\%s, xrefs: 00056B73, 00056E34, 00056F33, 00057094, 000570B4, 000570C0, 00057159
DATA, xrefs: 00056D11
"%s" --install . %s %s, xrefs: 00057206
There was an error while installing the application. Check the setup log for more information and contact the author., xrefs: 00057282
setup.json, xrefs: 00057081, 0005708C, 000570AC
\SquirrelTemp, xrefs: 00056A83
Teams-*.nupkg, xrefs: 0005714D
PF, xrefs: 000571DE
Update.exe, xrefs: 00056F1B
--exeName=, xrefs: 00056FBF
--bootstrapperMode, xrefs: 0005718B

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: File$Resource$ErrorLast$CloseCreateFindHandlePath$DeleteDirectoryFolderFreeModuleNameProcess$ActiveAttributesCodeCopyExecuteExistsExitFirstH_prolog3_LoadLockObjectShellSingleSizeofUserWaitWindow_strftime
String ID: --bootstrapperMode$"%s" --install . %s %s$%s\%s$%s\SquirrelSetup.log$--exeName=$D$DATA$ERROR: failed to extract installer$ERROR: there was an error while installing the application (see above)$Failed to extract installer$PF$Teams-*.nupkg$There was an error while installing the application. Check the setup log for more information and contact the author.$Unable to write to %s - IT policies may be restricting access to this folder$Update.exe$\SquirrelTemp$setup.json
API String ID: 1737328233-3443803010
Opcode ID: a7f62b6fff120137fbf46683793521d59743bfd60ca585641fd5d2486bba5d73
Instruction ID: 2dc7412f5c2a5ca1cf72878ec3a47b3dbee3bbc1470a352cc7dd08788bc167a8
Opcode Fuzzy Hash: a7f62b6fff120137fbf46683793521d59743bfd60ca585641fd5d2486bba5d73
Instruction Fuzzy Hash: E9529071D056289BDB20DB64DC55AEFB7B8AF14301F5401E9E90DA3182EB365F88CF51

Function 0005136F Relevance: 47.6, APIs: 13, Strings: 14, Instructions: 316
filecomsynchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 00051379
GetActiveWindow.USER32 ref: 0005141B

Part of subcall function 00051B05: LoadLibraryW.KERNEL32(comctl32.dll,?,00000001,?,?,?,00051893,00000000), ref: 00051B24
Part of subcall function 00051B05: GetProcAddress.KERNEL32(00000000,TaskDialogIndirect), ref: 00051B36
Part of subcall function 00051B05: FreeLibrary.KERNEL32(00000000,?,00000001,?,?,?,00051893,00000000), ref: 00051B59

GetTempPathW.KERNEL32(00000104,?,000006E4,0005E9CF,?,--allUsers,?,--rerunningWithoutUAC), ref: 000514AB
GetTempFileNameW.KERNEL32(?,NDP,00000000,?), ref: 000514E4
_wcsrchr.LIBVCRUNTIME ref: 00051525
MoveFileW.KERNEL32(?,?), ref: 0005155D
CoCreateInstance.OLE32(00086990,00000000,00000017,00094640,?), ref: 00051589
URLDownloadToFileW.URLMON(00000000,?,?,00000000,00000000), ref: 00051673
ShellExecuteExW.SHELL32(?), ref: 000516E7
WaitForSingleObject.KERNEL32(?,000000FF), ref: 00051702
GetExitCodeProcess.KERNEL32(?,?), ref: 00051722
CloseHandle.KERNEL32(?), ref: 0005178A
DeleteFileW.KERNEL32(00000000), ref: 000517A1

Strings

Downloading, xrefs: 0005159F
<, xrefs: 0005146F
/passive /norestart /showrmui, xrefs: 000516AF
/q /norestart, xrefs: 000516B4
H?, xrefs: 000513D3
H@, xrefs: 00051411
This application requires the .NET Framework 4.5. Click the Install button to get started., xrefs: 000513FD
LB, xrefs: 000516C6
NDP, xrefs: 000514D8
X?, xrefs: 000513E3
@, xrefs: 000516B9
h?, xrefs: 000513F3
Downloading the .NET Framework installer, xrefs: 000515BA
.exe, xrefs: 0005152E

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: File$LibraryTemp$ActiveAddressCloseCodeCreateDeleteDownloadExecuteExitFreeH_prolog3_HandleInstanceLoadMoveNameObjectPathProcProcessShellSingleWaitWindow_wcsrchr
String ID: .exe$/passive /norestart /showrmui$/q /norestart$<$@$Downloading$Downloading the .NET Framework installer$H?$H@$LB$NDP$This application requires the .NET Framework 4.5. Click the Install button to get started.$X?$h?
API String ID: 141064516-3346895843
Opcode ID: ffd374e4b7f0ec6b8a55fca470e62f2e29e35c0b907426fea3826e4277b63942
Instruction ID: c2f4d5eb7b0b7d721133e4e921a051e2ae532f740c42e83bcdd426680a789e28
Opcode Fuzzy Hash: ffd374e4b7f0ec6b8a55fca470e62f2e29e35c0b907426fea3826e4277b63942
Instruction Fuzzy Hash: 73C15171A002189FDB609F64CC84BEE77BAAF48311F1402E9E909E7291DB769E95CF50

Function 000556FA Relevance: 21.4, APIs: 7, Strings: 5, Instructions: 402timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00054975: SetFilePointer.KERNEL32(?,?,00000000,?), ref: 000549A8

MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,000000FF,?,00000104), ref: 0005588D
_wcsstr.LIBVCRUNTIME ref: 000558C2
_wcsstr.LIBVCRUNTIME ref: 000558D8
_wcsstr.LIBVCRUNTIME ref: 000558E9
_wcsstr.LIBVCRUNTIME ref: 000558FA
SystemTimeToFileTime.KERNEL32(?,?), ref: 00055A94
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00055AC0

Strings

\../, xrefs: 000558D2
\..\, xrefs: 000558BC
/..\, xrefs: 000558F4
$a, xrefs: 00055B27
/../, xrefs: 000558E3

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: FileTime_wcsstr$ByteCharLocalMultiPointerSystemWide
String ID: $a$/../$/..\$\../$\..\
API String ID: 2500941349-4132025507
Opcode ID: 68215cd92fec2bf19e1fe19bf26f329404cef62ad89302725913b3816ddcb56a
Instruction ID: 7d48342d4d15dd92bdc7d3ad10d5eda20531898aa8ee4ae388343c75ec9d9257
Opcode Fuzzy Hash: 68215cd92fec2bf19e1fe19bf26f329404cef62ad89302725913b3816ddcb56a
Instruction Fuzzy Hash: 80F1E571900A158BDB26CF28CC957EABBF4AF49312F1842E9D85DDB282D7349B85CF50

Function 0005248F Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 113COMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,0892D875,?,?,?,?,0008452B,000000FF), ref: 000524C8
GetModuleFileNameW.KERNEL32(00000000,?,00000400,?,?,?,?,0008452B,000000FF), ref: 000524DC
SHGetFolderPathW.SHELL32(00000000,0000001C,00000000,00000000,?,?,?,?,?,?,0008452B,000000FF), ref: 00052509

Part of subcall function 0005246D: GetFileAttributesW.KERNEL32(?,0005252F), ref: 0005246E
Part of subcall function 0005246D: GetLastError.KERNEL32 ref: 00052479

SHGetFolderPathW.SHELL32(00000000,00000023,00000000,00000000,?), ref: 00052545
GetUserNameW.ADVAPI32(?,?), ref: 00052559

Strings

\teams.exe, xrefs: 000525B5
\Microsoft\Teams\current, xrefs: 0005250F, 00052591

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: FileFolderModuleNamePath$AttributesErrorHandleLastUser
String ID: \Microsoft\Teams\current$\teams.exe
API String ID: 4174789944-1447158751
Opcode ID: c33e9d14424813447c8c2140e579e6f694d791f641361e2c19e19e29e5b1bc3f
Instruction ID: 05d789113843911e68cc44f0397b3296e61333e833a065fc06addabcf331288d
Opcode Fuzzy Hash: c33e9d14424813447c8c2140e579e6f694d791f641361e2c19e19e29e5b1bc3f
Instruction Fuzzy Hash: BD4181B290051CBADB20EB50DC45EEB77BCFF15700F0484A9B55592181EF755B89CFA0

Function 00051955 Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 55shutdownCOMMON

Download Yara Rule

APIs

LookupPrivilegeValueW.ADVAPI32(00094650,SeShutdownPrivilege,000518AA), ref: 00051974
GetCurrentProcess.KERNEL32(00000020,?,?,?,?,?,?,000518AA,00000000), ref: 00051989
OpenProcessToken.ADVAPI32(00000000,?,?,?,?,?,000518AA,00000000), ref: 00051990
AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000010,00000000,00000000), ref: 000519C0
CloseHandle.KERNEL32(?), ref: 000519CD
ExitWindowsEx.USER32(00000002,00000000), ref: 000519E5

Strings

SeShutdownPrivilege, xrefs: 0005196A

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ProcessToken$AdjustCloseCurrentExitHandleLookupOpenPrivilegePrivilegesValueWindows
String ID: SeShutdownPrivilege
API String ID: 2829607268-3733053543
Opcode ID: 82c9b885a861117d850f7aa475b52747f86f8e10fef1a73c03c85819b883e9f6
Instruction ID: ec3c70e48f7f021165c11b45b9e3346b438204a46a33dfe0a9c2968f8cc688f1
Opcode Fuzzy Hash: 82c9b885a861117d850f7aa475b52747f86f8e10fef1a73c03c85819b883e9f6
Instruction Fuzzy Hash: 07113670A01219ABEB109FA1DD09FEFBBB8FF09701F014015E901E6290D7798A04DBA0

Function 000760DE Relevance: 10.9, APIs: 7, Instructions: 370timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00076160
_free.LIBCMT ref: 00076184
_free.LIBCMT ref: 0007630B
GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0008CA00), ref: 0007631D
WideCharToMultiByte.KERNEL32(00000000,00000000,0009E4D4,000000FF,00000000,0000003F,00000000,?,?), ref: 00076395
WideCharToMultiByte.KERNEL32(00000000,00000000,0009E528,000000FF,?,0000003F,00000000,?), ref: 000763C2
_free.LIBCMT ref: 000764D7

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$ByteCharMultiWide$InformationTimeZone
String ID:
API String ID: 314583886-0
Opcode ID: f69441c08dff90660510bf08723d565484aa5ac5566b5d87b00f738028f5d75f
Instruction ID: bb93ed1b5f29c58fdbcf2e68853033d681f081d67c9a4063ec74e28dde0a6549
Opcode Fuzzy Hash: f69441c08dff90660510bf08723d565484aa5ac5566b5d87b00f738028f5d75f
Instruction Fuzzy Hash: DDC12A71D00A45AFDB60DF74CC41AEA7BF9AF41310F18C19AE48A97253E77A9E02C758

Function 0007FD1E Relevance: 10.1, APIs: 1, Strings: 4, Instructions: 1381COMMON

Download Yara Rule

APIs

__floor_pentium4.LIBCMT ref: 0007FE64

Strings

1#QNAN, xrefs: 0008106A
1#IND, xrefs: 0008105C
1#SNAN, xrefs: 00081063
1#INF, xrefs: 00081071

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: __floor_pentium4
String ID: 1#IND$1#INF$1#QNAN$1#SNAN
API String ID: 4168288129-2761157908
Opcode ID: 679290922c41a82f61a63ae0d918d331b57d52de88709dc37e3abe0bcf7a22a8
Instruction ID: f2e07e63506a3095949f58ef0941bc3253104b031ea41783b40d64488502a918
Opcode Fuzzy Hash: 679290922c41a82f61a63ae0d918d331b57d52de88709dc37e3abe0bcf7a22a8
Instruction Fuzzy Hash: 1AC24972E086288FDBA5DE28DD407EAB7B5FB44314F1441EAD48DE7241E778AE858F40

Function 0007F339 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 86COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(FDE8FE81,2000000B,00000000,00000002,00000000,?,?,?,0007F658,?,00000000), ref: 0007F3D2
GetLocaleInfoW.KERNEL32(FDE8FE81,20001004,00000000,00000002,00000000,?,?,?,0007F658,?,00000000), ref: 0007F3FB
GetACP.KERNEL32(?,?,0007F658,?,00000000), ref: 0007F410

Strings

ACP, xrefs: 0007F357
OCP, xrefs: 0007F38D

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: b9a49dc0e9794287c1eeb1753422abcee6501b2d82aa2f3adcf639441b4b4008
Instruction ID: f4f0619aa04b89c090da76299ef5ed18dc196cec1aaff7789e6cbf9bab285bff
Opcode Fuzzy Hash: b9a49dc0e9794287c1eeb1753422abcee6501b2d82aa2f3adcf639441b4b4008
Instruction Fuzzy Hash: AD219D72E00106ABEB709F24C904ABB73E6EF54B60B56C474E90ED7101EB3ADE41C398

Function 0005A1C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005A1CA
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\VMware, Inc.\VMware VDM,00000000,?,?,000000A4,0005A421), ref: 0005A1E6

Part of subcall function 00059BDF: __EH_prolog3.LIBCMT ref: 00059BE6

Part of subcall function 0005A168: __EH_prolog3.LIBCMT ref: 0005A16F

Strings

PF, xrefs: 0005A27D
AgentInstallPath, xrefs: 0005A233
SOFTWARE\VMware, Inc.\VMware VDM, xrefs: 0005A1D9, 0005A253

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: H_prolog3$H_prolog3_Open
String ID: AgentInstallPath$PF$SOFTWARE\VMware, Inc.\VMware VDM
API String ID: 1546091839-1160515840
Opcode ID: c2fb7544d01d052e3cc72d55e5ccc6c385212333c48608263ddbfb72f2df676a
Instruction ID: a8b1be10798e3fe85f6110db2bd982da7e6ec6a57b0ae3e84ba3977439509524
Opcode Fuzzy Hash: c2fb7544d01d052e3cc72d55e5ccc6c385212333c48608263ddbfb72f2df676a
Instruction Fuzzy Hash: D9214F70D0134CDADF14EFA4D942ADEBBB8AF15305F50806EA8196B242EB755A0DDB11

Function 0007F50D Relevance: 7.7, APIs: 5, Instructions: 188COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

Part of subcall function 00073D25: _free.LIBCMT ref: 00073D84
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D91

GetUserDefaultLCID.KERNEL32(?,?,?), ref: 0007F619
IsValidCodePage.KERNEL32(00000000), ref: 0007F674
IsValidLocale.KERNEL32(?,00000001), ref: 0007F683
GetLocaleInfoW.KERNEL32(?,00001001,000723EB,00000040,?,0007250B,00000055,00000000,?,?,00000055,00000000), ref: 0007F6CB
GetLocaleInfoW.KERNEL32(?,00001002,0007246B,00000040), ref: 0007F6EA

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLastLocale$InfoValid_free$CodeDefaultPageUser
String ID:
API String ID: 2287132625-0
Opcode ID: e6ddf08eeea9cfb2d0c2c3b225fd07153eb6b28ccff9cb5929786d2d090e807e
Instruction ID: 6a2617175a127b0ea971bcf019ed8f63442db8252e1569b12ab9df87f67a86ac
Opcode Fuzzy Hash: e6ddf08eeea9cfb2d0c2c3b225fd07153eb6b28ccff9cb5929786d2d090e807e
Instruction Fuzzy Hash: A0517072D00606ABEB60EFA5DC45EBE77F8BF08700F148475EA58E7191D77899008B65

Function 0007EBC2 Relevance: 6.3, APIs: 4, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

IsValidCodePage.KERNEL32(00000000,?,?,?,?,?,?,000723F2,?,?,?,?,00071E49,?,00000004), ref: 0007ECA4
_wcschr.LIBVCRUNTIME ref: 0007ED34
_wcschr.LIBVCRUNTIME ref: 0007ED42
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078,000723F2,00000000,00072512), ref: 0007EDF4

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast_wcschr$CodeInfoLocalePageValid_free
String ID:
API String ID: 2444527052-0
Opcode ID: 861a4366509d91c58988d0ecb1aa4d156917f78f219f55b0af78649a8ca3b821
Instruction ID: 6f949a1ea6043899183b312c63d4a0a6a1f32065a824215f9005514e578e337a
Opcode Fuzzy Hash: 861a4366509d91c58988d0ecb1aa4d156917f78f219f55b0af78649a8ca3b821
Instruction Fuzzy Hash: A961FC71D01646AAD725AB34CC46AE773D8FF08710F1484A9F90DD7182EB78ED418768

Function 00063ADC Relevance: 6.0, APIs: 4, Instructions: 12COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00063BFB,00089DAC,00000017), ref: 00063AE1
UnhandledExceptionFilter.KERNEL32(00089DAC,?,00063BFB,00089DAC,00000017), ref: 00063AEA
GetCurrentProcess.KERNEL32(C0000409,?,00063BFB,00089DAC,00000017), ref: 00063AF5
TerminateProcess.KERNEL32(00000000,?,00063BFB,00089DAC,00000017), ref: 00063AFC

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentTerminate
String ID:
API String ID: 3231755760-0
Opcode ID: d0a355019ee06d12c10092a5f38e396bf16c5f721aa88f7b9dd2efd6a7e25b87
Instruction ID: 05db3ce57ce6a6b81ba45631ca1ee09d154257e09a4af52713c2446804b17824
Opcode Fuzzy Hash: d0a355019ee06d12c10092a5f38e396bf16c5f721aa88f7b9dd2efd6a7e25b87
Instruction Fuzzy Hash: 6ED01232084208ABEF002BE0ED0CA8D3F28FB08713F0A4400F38A8A063CB3B84048B65

Function 0007EFC0 Relevance: 4.7, APIs: 3, Instructions: 205COMMON

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

Part of subcall function 00073D25: _free.LIBCMT ref: 00073D84
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D91

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0007F014
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0007F065
GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0007F125

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorInfoLastLocale$_free
String ID:
API String ID: 2834031935-0
Opcode ID: 8b82dca9d0fdf5be76e5d4f396ca026fad99a60d11587d6ba61592514c4147fa
Instruction ID: 1e7be17e30c52751a09655a67e7b5ffcd1c94de94ef35f1194846277473002aa
Opcode Fuzzy Hash: 8b82dca9d0fdf5be76e5d4f396ca026fad99a60d11587d6ba61592514c4147fa
Instruction Fuzzy Hash: 2F619071D0010BDBEB789F28CC86BBA77E8FF04314F208079E909C6682EB799951DB54

Function 00068A5F Relevance: 4.6, APIs: 3, Instructions: 78COMMONLIBRARYCODE

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 00068B57
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 00068B61
UnhandledExceptionFilter.KERNEL32(00051A5A), ref: 00068B6E

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ExceptionFilterUnhandled$DebuggerPresent
String ID:
API String ID: 3906539128-0
Opcode ID: 4a370382e707f86761bdc7a7e9b7c02f8ebecfff6c4572a86412af65490897b8
Instruction ID: 6ce443ce65bc14241f7e171b637048449894394725d607ce3d0c8c1c12b7413d
Opcode Fuzzy Hash: 4a370382e707f86761bdc7a7e9b7c02f8ebecfff6c4572a86412af65490897b8
Instruction Fuzzy Hash: 6D31D4B49012189BCB61DF64D889BCDBBB8BF08310F5042EAE80CA7251EB359F858F44

Function 0007C0A5 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 127COMMON

Download Yara Rule

Strings

/, xrefs: 0007C16F

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID: /
API String ID: 0-2043925204
Opcode ID: ebd4bbc564060de7b0b3c1cee081c6acdd3577ca0d32e056764bfe0b1d12f4fb
Instruction ID: fd79d971cb05766c60fe36adbf83a30504bf3ab8a1265372196ed41353b5cf3d
Opcode Fuzzy Hash: ebd4bbc564060de7b0b3c1cee081c6acdd3577ca0d32e056764bfe0b1d12f4fb
Instruction Fuzzy Hash: F5412972D00218AADB20DFB8CC49DAB77B9EB85710F50826DF909D7182E6359D81CB98

Function 000754CF Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 37COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(00000000,00000002,00000000,?,20001004,?,20001004,?,00000002,?,?,00071E49,?,00000004), ref: 00075522

Strings

GetLocaleInfoEx, xrefs: 000754E0, 000754EA

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: InfoLocale
String ID: GetLocaleInfoEx
API String ID: 2299586839-2904428671
Opcode ID: a55d9c9c7d8a70bb73897bb2ad1001d3b70767e49de57c7fd902f4c5fa13d5b1
Instruction ID: d84895a58a9205c46333866cd0a6cbb2d225afcf5367ad579c83888c5fa64402
Opcode Fuzzy Hash: a55d9c9c7d8a70bb73897bb2ad1001d3b70767e49de57c7fd902f4c5fa13d5b1
Instruction Fuzzy Hash: C5F0F631A40A0CB7EB016F609C06FAE7B61FF04B11F008058F8486A252CE764E209BD5

Function 00075539 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 30timeCOMMON

Download Yara Rule

APIs

GetSystemTimeAsFileTime.KERNEL32(00000000,0006C2FD), ref: 00075578

Strings

GetSystemTimePreciseAsFileTime, xrefs: 0007554A, 00075554

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: Time$FileSystem
String ID: GetSystemTimePreciseAsFileTime
API String ID: 2086374402-595813830
Opcode ID: 2a25a5cde5ae383f090f323e8ef6effbf03866921637e0c7b2d3507111d3036d
Instruction ID: c2f364a7896c007ff98cf2d8b15bc2fe7dbc9e61bca5ec415b40cfdb16e1cc71
Opcode Fuzzy Hash: 2a25a5cde5ae383f090f323e8ef6effbf03866921637e0c7b2d3507111d3036d
Instruction Fuzzy Hash: 43E05C30E00614E7F6107F609C0BDBD7761FB08B41B054199F8441B252CD7A0E0093E5

Function 0006EC80 Relevance: 3.5, APIs: 2, Instructions: 464COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 42cd25f777c8f5c8951594b72c91f75c2886a065ef5a19eff3048bf57fa6caac
Instruction ID: 229396d8f0b3008103c5a2a9ad032680b146662eac23e79b414c449f70238fc4
Opcode Fuzzy Hash: 42cd25f777c8f5c8951594b72c91f75c2886a065ef5a19eff3048bf57fa6caac
Instruction Fuzzy Hash: 49022D75E002199FDF14CFA9D8806ADB7F2FF88314F254169E919EB385D731AA41CB90

Function 00078EA4 Relevance: 1.8, APIs: 1, Instructions: 269COMMONLIBRARYCODE

Download Yara Rule

APIs

RaiseException.KERNEL32(C000000D,00000000,00000001,?,?,00000008,?,?,00078E9F,?,?,00000008,?,?,00082A4A,00000000), ref: 000790D1

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ExceptionRaise
String ID:
API String ID: 3997070919-0
Opcode ID: 7c98a38d971a8ca9a042bbf0177d2d52f48a6cfe9de9b4975eba66442c44168d
Instruction ID: a17d09fc6eaa1157b4c943f4a26f649f140f34bd7bcd7151222fec3d20ec9b4a
Opcode Fuzzy Hash: 7c98a38d971a8ca9a042bbf0177d2d52f48a6cfe9de9b4975eba66442c44168d
Instruction Fuzzy Hash: 23B17A31A20609DFD764CF28C48AB647BE1FF45364F25C658E89ACF2A1C339E991CB44

Function 0007F210 Relevance: 1.6, APIs: 1, Instructions: 83COMMON

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

Part of subcall function 00073D25: _free.LIBCMT ref: 00073D84
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D91

GetLocaleInfoW.KERNEL32(00000000,?,?,00000078), ref: 0007F264

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast$_free$InfoLocale
String ID:
API String ID: 2955987475-0
Opcode ID: 7214f4d11faf5db9e564a769789daf66f31b76e59ec42fac81d3841c864e457d
Instruction ID: b405fbdbbe144a3ec1570b729a985c29daa1bec495f1bd411b26bf0bdfa46bcf
Opcode Fuzzy Hash: 7214f4d11faf5db9e564a769789daf66f31b76e59ec42fac81d3841c864e457d
Instruction Fuzzy Hash: 2621B376D0010BABEB249E28DC46BBA73E8FB04310F10817AED09D6183EB799D41D758

Function 0007EE94 Relevance: 1.6, APIs: 1, Instructions: 63COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

EnumSystemLocalesW.KERNEL32(0007EFC0,00000001,00000000,?,000723EB,?,0007F5ED,00000000,?,?,?), ref: 0007EF06

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 92d2762260f51f59c1cc7311ad285e16a4a77a08a752babf4d29228db697f9ce
Instruction ID: e1059dac33707c4755e9215df0d76150f14bd1c802c3ad8f7ce350e5cfc4d12f
Opcode Fuzzy Hash: 92d2762260f51f59c1cc7311ad285e16a4a77a08a752babf4d29228db697f9ce
Instruction Fuzzy Hash: C41125366007055FDB189F38D8916BABB92FF84328B18883CE98A87A41D779B943C744

Function 0007F440 Relevance: 1.5, APIs: 1, Instructions: 46COMMON

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

GetLocaleInfoW.KERNEL32(?,20000001,?,00000002,?,00000000,?,?,0007F1DE,00000000,00000000,?), ref: 0007F46C

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast$InfoLocale_free
String ID:
API String ID: 787680540-0
Opcode ID: 89ac9edde149f9300ab3344170b769d323d15a7e7612a2d027562ac0c108692e
Instruction ID: 154c05d4f752928d5ea2a672943b2cc97e743ae4693f5b478d912b86b87e7d98
Opcode Fuzzy Hash: 89ac9edde149f9300ab3344170b769d323d15a7e7612a2d027562ac0c108692e
Instruction Fuzzy Hash: 00F0D136E50116ABDB289A648805BBB7BA8EB40764F05C479EC49A3140EB78BD018694

Function 0007EF2F Relevance: 1.5, APIs: 1, Instructions: 42COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

EnumSystemLocalesW.KERNEL32(0007F210,00000001,?,?,000723EB,?,0007F5B1,000723EB,?,?,?,?,?,000723EB,?,?), ref: 0007EF7B

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 7ec3903e35f02b8b62525f9b52df9f244e34f735ef902cf169b8a8adef9a224b
Instruction ID: 620e331c89e30dea358b499ea499925e39c133f2833c7d03765cfc60228817a7
Opcode Fuzzy Hash: 7ec3903e35f02b8b62525f9b52df9f244e34f735ef902cf169b8a8adef9a224b
Instruction Fuzzy Hash: 0BF04C3A7003455FDB149F39DC85A777BD1FF84328B05847CF9498BA41D675AC028744

Function 00074FE6 Relevance: 1.5, APIs: 1, Instructions: 34COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0006E8E1: EnterCriticalSection.KERNEL32(-00035119,?,000709CA,00000000,0009A690,0000000C,00070985,?,?,?,00074F6F,?,?,00073DDA), ref: 0006E8F0

EnumSystemLocalesW.KERNEL32(00074FA0,00000001,0009A818,0000000C), ref: 0007501E

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CriticalEnterEnumLocalesSectionSystem
String ID:
API String ID: 1272433827-0
Opcode ID: 9114928e4b23e97d6f8239fc0c0c1498df7d6f453dabf474896b4ad75a1594b6
Instruction ID: 743a6ab30ad0c38b20bf86b40c23780c14072e088280487775fbf2b7c6372358
Opcode Fuzzy Hash: 9114928e4b23e97d6f8239fc0c0c1498df7d6f453dabf474896b4ad75a1594b6
Instruction Fuzzy Hash: 30F06232A50300EFEB10EF68D84AF9D77A1FB45720F108126F514DF2A2CB7989459F95

Function 0007EE49 Relevance: 1.5, APIs: 1, Instructions: 31COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

EnumSystemLocalesW.KERNEL32(0007EDA0,00000001,?,?,?,0007F60F,000723EB,?,?,?,?,?,000723EB,?,?,?), ref: 0007EE80

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast$EnumLocalesSystem_free
String ID:
API String ID: 2016158738-0
Opcode ID: 3ffd85be1efe5fa7697790b0e8371a3e243943b608809cacb6e214893fa2e955
Instruction ID: b2eb44c9f6ed471fe913a822ab1858347e389d1e16e4d68bdeebfe4ad55f1f3a
Opcode Fuzzy Hash: 3ffd85be1efe5fa7697790b0e8371a3e243943b608809cacb6e214893fa2e955
Instruction Fuzzy Hash: 03F0553670024457CB149F35D809A6BBFD0EFC1724F0A8498EA098B242C6399D42C794

Function 00054608 Relevance: 1.5, Strings: 1, Instructions: 261COMMON

Download Yara Rule

Strings

^, xrefs: 000548FB

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID: ^
API String ID: 0-3117767906
Opcode ID: 28a1d28ee76c96a6f111adbe5a4dec7f5d57bcaa5044e5f7d663235b75758b32
Instruction ID: 04a757b1f40fb4c3bcacdff040048ec8368d5afd658b05c6d5b7b86e29270411
Opcode Fuzzy Hash: 28a1d28ee76c96a6f111adbe5a4dec7f5d57bcaa5044e5f7d663235b75758b32
Instruction Fuzzy Hash: E2B11775604B40CFD374CF19D480A67B7F0FF4931AB248A5ED8AA8B691DB71E84ACB50

Function 000648F3 Relevance: 1.5, APIs: 1, Instructions: 3COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(Function_00014900,00064385), ref: 000648F8

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 0d8c2a62a8948190e941f55e68450e984b990af38e1c23259490544645eeddae
Instruction ID: 8ab083b89f598ed95e4cf09524559f61c8849390eacd81e46de0a45202095958
Opcode Fuzzy Hash: 0d8c2a62a8948190e941f55e68450e984b990af38e1c23259490544645eeddae
Instruction Fuzzy Hash:

Function 0006A6F7 Relevance: 1.5, Strings: 1, Instructions: 214COMMON

Download Yara Rule

Strings

0, xrefs: 0006A867

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID: 0
API String ID: 0-4108050209
Opcode ID: f526345d3ee21fbd9cb22311744de03c1e16cbe8df4fbc18343d6ca12f6fa895
Instruction ID: ee33b164fc083bed24eca0a9f50eae258de3ef1b8a835ed32d9d7c7f05f4871c
Opcode Fuzzy Hash: f526345d3ee21fbd9cb22311744de03c1e16cbe8df4fbc18343d6ca12f6fa895
Instruction Fuzzy Hash: EF5123607087455ADBB8BA688855BFE37EB9B07300F180519E842F7283CA15EE469F67

Function 0007CFF0 Relevance: 1.3, APIs: 1, Instructions: 5memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32 ref: 0007CFF0

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 4ea0307d6d2f8c53246c79fda3500cea45f5ffd965f20414505493b9b1647547
Instruction ID: ab9a4dc3c321fe9299159e8759b09398d4e01284f4eb345e1042b1dc8fac3c93
Opcode Fuzzy Hash: 4ea0307d6d2f8c53246c79fda3500cea45f5ffd965f20414505493b9b1647547
Instruction Fuzzy Hash: 31A00170601642CBA7448F36EE1930A3AA9BB45695716816AE485C6260EA2E88549F16

Function 0007AA89 Relevance: .6, Instructions: 637COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b173ee1175638a07f458a71e2a42e2587e17170a87c4b2d8671f224259587cf
Instruction ID: a4c468c303e79da29166fdbc8c0765b87bf16e76580425e452fc432e9e8305c1
Opcode Fuzzy Hash: 7b173ee1175638a07f458a71e2a42e2587e17170a87c4b2d8671f224259587cf
Instruction Fuzzy Hash: 1D320432D29F414DE7639635D82233A6298AFB73C4F15D727E81EB59A6EF2DC4834204

Function 000537E3 Relevance: .4, Instructions: 357COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7aabed3a5e9c4c28f58ab05e4a1f1de66fc3ccdd445d2aaa64efda40334578e2
Instruction ID: 0c8a899603a15e5b4f177081a0c02ab89b4aff0b62acce17bb07a49be9313b2a
Opcode Fuzzy Hash: 7aabed3a5e9c4c28f58ab05e4a1f1de66fc3ccdd445d2aaa64efda40334578e2
Instruction Fuzzy Hash: D5F1C375A002298FDB64CF28C990B9DBBB1BB89354F1081EAD94DE7341DB30AE858F51

Function 00066C20 Relevance: .3, Instructions: 254COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction ID: 3298677d448e7df9c7955aa1761885b44159706600e494e0f7960b6644590fd7
Opcode Fuzzy Hash: 93657a121f16255c59120ad0d08fdbba6372c273009ad596b4ecdf6e8f3c6909
Instruction Fuzzy Hash: 199144726090A34ADBAD467AC47403EFFE39B523B131A079ED4F3CA1C5EE26D564D620

Function 00066EDB Relevance: .2, Instructions: 244COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction ID: d0d6f313382ce4636bdb0439db4c85097947db15508da30ffac1ea990e2e7eca
Opcode Fuzzy Hash: 05e0b846b00456d0f1e87463b9d189974beed2fe63262d4392584e128a114ea2
Instruction Fuzzy Hash: 6291637210C0A34AEBA9463E953403EFFE25B523A531A07AEE4F6CE1C5EE25D564D630

Function 00066959 Relevance: .2, Instructions: 240COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction ID: 9858addd7b71753bcecaf8395c32b49b25f65f573fd062233020885b23c783fb
Opcode Fuzzy Hash: 40101273f58913c3cb3bc7eb54df01d47b4121c3e67d19f11ec2cb23d33ea445
Instruction Fuzzy Hash: 5B91767220D0E34ADBAD467D857443EFFE25B523A131A07ADD8F2CA1C1FE26D954DA20

Function 0006AB55 Relevance: .2, Instructions: 237COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 711e54b6a647ca57f22ea7b72b32d5ba6a9dec904292dc30466d30218b7dc8c1
Instruction ID: 78b4f387e0aad192f3c69ccbcbcc6105572878d884a03fa4a248918b3034c1d0
Opcode Fuzzy Hash: 711e54b6a647ca57f22ea7b72b32d5ba6a9dec904292dc30466d30218b7dc8c1
Instruction Fuzzy Hash: C161127170060867DA787A288996BFE73D7AF43720F100919E943FB683DB159D818F57

Function 000666AF Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction ID: b646bd731d9cddb5763885fed90e1ae4e91df49b181b2e64c022b486eda1ea9b
Opcode Fuzzy Hash: 70da388f96bbbf26b230a155b4728740b34f0d100ea60ab2bbadb9d7d0befbf0
Instruction Fuzzy Hash: BB81657220D0A34EDBAD463A857803EFFE35B523A571A079ED4F2CB1C1ED26D564D620

Function 0006A926 Relevance: .2, Instructions: 214COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3ca4663100456a87e8384f31849fa4c89d694d986296229a1de10c568264c689
Instruction ID: 320c3db28dfc09ac99909861b4706c5819da84e84ff29679742f9cac4300e2e4
Opcode Fuzzy Hash: 3ca4663100456a87e8384f31849fa4c89d694d986296229a1de10c568264c689
Instruction Fuzzy Hash: 9151137171060456DB74B9A886567FFA3DB9B03300F29090AE982F7283C715EE41DE77

Function 00066290 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 2420866c9b6c2f81e96565d8d809c50c50959bd0056c59bc815fef554ee3061b
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 02113DB72005A343D7948A7DC9B86BBA7D7FFC532176C437AD0424B758D223EA45D600

Function 0005426D Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4c5d0649ebac5da90668a9ce5a29fb58cf8148636bfff916d9c3310fdd9b855a
Instruction ID: 5b4de6fa5efe25dee57a404dd640b23f549649d783d298b36d08238e4293d3f5
Opcode Fuzzy Hash: 4c5d0649ebac5da90668a9ce5a29fb58cf8148636bfff916d9c3310fdd9b855a
Instruction Fuzzy Hash: B12133755340B10A974C4F3ABC21877BBE0AB4720738B42ABED97EA0D2C52DD575D7A0

Function 0005F82D Relevance: 37.0, APIs: 16, Strings: 5, Instructions: 258
memorystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__EH_prolog3_GS.LIBCMT ref: 0005F834
CoTaskMemAlloc.OLE32(?,00000070,00060C00,?,00000000,00000000,00000000), ref: 0005F89D
_wcsstr.LIBVCRUNTIME ref: 0005F909
CharNextW.USER32(?), ref: 0005F91A
CharNextW.USER32(00000000), ref: 0005F923
CharNextW.USER32(00000000), ref: 0005F92C
CharNextW.USER32(00000000), ref: 0005F935
CharNextW.USER32(?), ref: 0005F96E
CharNextW.USER32(?), ref: 0005F980
CharNextW.USER32(00000000,}}), ref: 0005F9F0
EnterCriticalSection.KERNEL32(00000011,?,?,?,?,?,00060EAF,00000000,?), ref: 0005FA45
lstrcmpiW.KERNEL32(?,?,?,?,?,?,?,00060EAF,00000000,?), ref: 0005FA61
LeaveCriticalSection.KERNEL32(?,00000000,?,?,?,?,?,00060EAF,00000000,?), ref: 0005FA8D
CharNextW.USER32(?,00000000,?,?,?,?,?,00060EAF,00000000,?), ref: 0005FAAD
CharNextW.USER32(?,00000000,00000001,00000070,00060C00,?,00000000,00000000,00000000), ref: 0005FACC

Part of subcall function 0005F797: CoTaskMemRealloc.OLE32(?,?,00000002,?,?,0005F710,00000000,-00000002,00000008,C000008C,00000001,?,0005F366,00000000,00000010,00000000), ref: 0005F7DB

CoTaskMemFree.OLE32(?,00000070,00060C00,?,00000000,00000000,00000000), ref: 0005FB0C

Strings

}}, xrefs: 0005F9C9
HKCU{Software{Classes, xrefs: 0005F93B
', xrefs: 0005F8E5
HKCR, xrefs: 0005F903
%, xrefs: 0005F8EC

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CharNext$Task$CriticalSection$AllocEnterFreeH_prolog3_LeaveRealloc_wcsstrlstrcmpi
String ID: }}$%$'$HKCR$HKCU{Software{Classes
API String ID: 2038073834-792530599
Opcode ID: 73e29ca228b70bdf2abd99ddcfa2267a1a5396e7b7dc149d22861747e6502459
Instruction ID: 4fbe4d580f9c86550162fa8396d37ff59d7c66f01e4bbd4e3fea34ea5fab9d67
Opcode Fuzzy Hash: 73e29ca228b70bdf2abd99ddcfa2267a1a5396e7b7dc149d22861747e6502459
Instruction Fuzzy Hash: DF917B71A00646DFEF219FA8C8546BFBBF5BF14302B244179EC46AB295DB399C48CB41

Function 0005A2BE Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 168registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005A2C8
GetCurrentProcess.KERNEL32 ref: 0005A30A
IsWow64Process.KERNEL32(00000000), ref: 0005A311
RegOpenKeyExW.ADVAPI32(80000002,SOFTWARE\Citrix\PortICA,00000000,00020019,?), ref: 0005A337

Part of subcall function 00059BDF: __EH_prolog3.LIBCMT ref: 00059BE6

Part of subcall function 0005A168: __EH_prolog3.LIBCMT ref: 0005A16F

Strings

vmware, xrefs: 0005A425
none, xrefs: 0005A2EA
SOFTWARE\Microsoft\Teams, xrefs: 0005A43C, 0005A4B8
citrix-xen-app, xrefs: 0005A410
SOFTWARE\Citrix\PortICA, xrefs: 0005A32D, 0005A3A9
IsWVDEnvironment, xrefs: 0005A49D
wvd, xrefs: 0005A513
citrix-xen-desktop, xrefs: 0005A406
PorticaV2, xrefs: 0005A38E

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: H_prolog3Process$CurrentH_prolog3_OpenWow64
String ID: IsWVDEnvironment$PorticaV2$SOFTWARE\Citrix\PortICA$SOFTWARE\Microsoft\Teams$citrix-xen-app$citrix-xen-desktop$none$vmware$wvd
API String ID: 3725901634-4114808235
Opcode ID: 06626a8f0d0cb905e9468a4f7558f3755aa39660f0a4b2d460eb410b777734be
Instruction ID: 30124f2e30c019a8b8eee56007c6b61dbf30517888248cfe17a93144744ee386
Opcode Fuzzy Hash: 06626a8f0d0cb905e9468a4f7558f3755aa39660f0a4b2d460eb410b777734be
Instruction Fuzzy Hash: DC615A30E05348DEDF20DFA4C946BEEBBB4AF05305F50405EE949AB282EB755A08DF51

Function 0006E2E0 Relevance: 22.8, APIs: 15, Instructions: 296COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0006E350
_free.LIBCMT ref: 0006E366
_free.LIBCMT ref: 0006E377
_free.LIBCMT ref: 0006E388
_free.LIBCMT ref: 0006E39F
GetCPInfo.KERNEL32(?,?), ref: 0006E3E7

Part of subcall function 00079680: _free.LIBCMT ref: 000796EB

_free.LIBCMT ref: 0006E593
_free.LIBCMT ref: 0006E5A6
_free.LIBCMT ref: 0006E5B4
_free.LIBCMT ref: 0006E5BF
_free.LIBCMT ref: 0006E601
_free.LIBCMT ref: 0006E609
_free.LIBCMT ref: 0006E611
_free.LIBCMT ref: 0006E619
_free.LIBCMT ref: 0006E627

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$Info
String ID:
API String ID: 2509303402-0
Opcode ID: 0d83b5ff0f9d3c97f4d48cad1ade837f2983f368f2ce80dfc67e07344eeef024
Instruction ID: 0ccea0f9e37da453552223b5d4d176d1db820e5e8ee71e3f91539fbce53a17bc
Opcode Fuzzy Hash: 0d83b5ff0f9d3c97f4d48cad1ade837f2983f368f2ce80dfc67e07344eeef024
Instruction Fuzzy Hash: 26B19E75D003459FDB20DF78C881BEEBBF5BF08304F144469F499A7292EB75A9459B20

Function 00060D30 Relevance: 21.1, APIs: 8, Strings: 4, Instructions: 119libraryCOMMON

Download Yara Rule

APIs

__EH_prolog3_catch_GS.LIBCMT ref: 00060D3A
LoadLibraryExW.KERNEL32(?,00000000,00000060,@q,Module,?), ref: 00060D85
LoadLibraryExW.KERNEL32(?,00000000,00000002), ref: 00060D9B
FindResourceW.KERNEL32(00000000,?,?), ref: 00060DC6
LoadResource.KERNEL32(00000000,00000000), ref: 00060DDE
SizeofResource.KERNEL32(00000000,00000000), ref: 00060DF0

Part of subcall function 00051D87: GetLastError.KERNEL32(000514BA), ref: 00051D87

FreeLibrary.KERNEL32(00000000), ref: 00060EB6

Strings

Module_Raw, xrefs: 000610C3
Module, xrefs: 000610A3
@q, xrefs: 00060F6A, 00060F70
REGISTRY, xrefs: 000610EF

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: LibraryLoadResource$ErrorFindFreeH_prolog3_catch_LastSizeof
String ID: @q$Module$Module_Raw$REGISTRY
API String ID: 1818814483-62667570
Opcode ID: 9fe8ce5e2bf86e31c81e071ff3773b21222575b93ed1b7ffeef86fc34598557f
Instruction ID: c52c0f9432bf1b5d6abf3a7261afface20f239e38a43369ed72a21b264a4b665
Opcode Fuzzy Hash: 9fe8ce5e2bf86e31c81e071ff3773b21222575b93ed1b7ffeef86fc34598557f
Instruction Fuzzy Hash: 8441C5B1A402299FDB219F54CC44BEF7AFAEF48310F414499F609A7252D7358E40CF58

Function 0005C783 Relevance: 21.1, APIs: 2, Strings: 10, Instructions: 96registryCOMMON

Download Yara Rule

APIs

RegGetValueW.ADVAPI32(80000002,Software\Policies\Microsoft\Office\16.0\Teams,AllowMsiOverride,00000010,?,00000000,?,00000400,?,00000000), ref: 0005C7D4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,?,00000000), ref: 0005C808

Part of subcall function 0005C498: GetFileVersionInfoSizeExW.VERSION(00000002,?,?,?,?,?,?,?,?,?,0005C83B,?,00000000), ref: 0005C4BF
Part of subcall function 0005C498: GetFileVersionInfoExW.VERSION(00000002,?,00000000,?,?,00000000,00000000,?,?,?,?,?,?,0005C83B,?,00000000), ref: 0005C4F3
Part of subcall function 0005C498: VerQueryValueW.VERSION(?,00095EE8,?,?,?,?,?,?,?,?,0005C83B,?,00000000), ref: 0005C511

Strings

the version of the Setup file is invalid - skipping installation, xrefs: 0005C86A
Setup version is , xrefs: 0005C84C
App version is , xrefs: 0005C890
The app version already installed is not older than the setup version, skipping installation, xrefs: 0005C8B0
could not get the full path of the Setup file - skipping installation, xrefs: 0005C812
could not get the Setup version - skipping installation, xrefs: 0005C83F
Software\Policies\Microsoft\Office\16.0\Teams, xrefs: 0005C7C8
AllowMsiOverride, xrefs: 0005C7C3
entered MsiOverride mode, xrefs: 0005C7ED
Setup version is newer, re-installing Teams from the machine-wide installer..., xrefs: 0005C8BA

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: File$InfoValueVersion$ModuleNameQuerySize
String ID: AllowMsiOverride$App version is $Setup version is $Setup version is newer, re-installing Teams from the machine-wide installer...$Software\Policies\Microsoft\Office\16.0\Teams$The app version already installed is not older than the setup version, skipping installation$could not get the Setup version - skipping installation$could not get the full path of the Setup file - skipping installation$entered MsiOverride mode$the version of the Setup file is invalid - skipping installation
API String ID: 3751987224-1774502221
Opcode ID: f7bdae517dc25a5fe4dc8c74fad4da93f11742345f409036256a26eb378ced4c
Instruction ID: ac602a02e5126fa7c8b9c7c5088a41a58a9879db678bfb67512c4608c73988d0
Opcode Fuzzy Hash: f7bdae517dc25a5fe4dc8c74fad4da93f11742345f409036256a26eb378ced4c
Instruction Fuzzy Hash: 9A3192319003189EEB209B54C851FFBB3F9EB84305F0484A9998666181DE766E8DDFA1

Function 0007E1A1 Relevance: 19.6, APIs: 13, Instructions: 114COMMONLIBRARYCODE

Download Yara Rule

APIs

___free_lconv_mon.LIBCMT ref: 0007E1E5

Part of subcall function 0007D518: _free.LIBCMT ref: 0007D535
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D547
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D559
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D56B
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D57D
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D58F
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D5A1
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D5B3
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D5C5
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D5D7
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D5E9
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D5FB
Part of subcall function 0007D518: _free.LIBCMT ref: 0007D60D

_free.LIBCMT ref: 0007E1DA

Part of subcall function 00073E7A: HeapFree.KERNEL32(00000000,00000000,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?), ref: 00073E90
Part of subcall function 00073E7A: GetLastError.KERNEL32(?,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?,?), ref: 00073EA2

_free.LIBCMT ref: 0007E1FC
_free.LIBCMT ref: 0007E211
_free.LIBCMT ref: 0007E21C
_free.LIBCMT ref: 0007E23E
_free.LIBCMT ref: 0007E251
_free.LIBCMT ref: 0007E25F
_free.LIBCMT ref: 0007E26A
_free.LIBCMT ref: 0007E2A2
_free.LIBCMT ref: 0007E2A9
_free.LIBCMT ref: 0007E2C6
_free.LIBCMT ref: 0007E2DE

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast___free_lconv_mon
String ID:
API String ID: 161543041-0
Opcode ID: e32ff4f9f5c9429254bdc2bdc3e8fd2d4e2189ca01cca23fa9f6c86681335fa9
Instruction ID: 9c0d505244dfe9c467a2fa169c2795ef11ba50be94e89a4e8996e6d2ce9738f3
Opcode Fuzzy Hash: e32ff4f9f5c9429254bdc2bdc3e8fd2d4e2189ca01cca23fa9f6c86681335fa9
Instruction Fuzzy Hash: 38317C31E052459FEB70AA78D805B9A77EDFF05310F11C45AF44DD72A2DA38AD81D728

Function 0007D620 Relevance: 18.4, APIs: 12, Instructions: 376COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0007D668
_free.LIBCMT ref: 0007D68C
_free.LIBCMT ref: 0007D699
_free.LIBCMT ref: 0007D6BE
_free.LIBCMT ref: 0007D6CB
_free.LIBCMT ref: 0007D6D4
_free.LIBCMT ref: 0007D9B2
_free.LIBCMT ref: 0007D9BA

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 2806fa42b057277d932b817fcd0406b86e3b74e3c67680df67975127122c3356
Instruction ID: b6841c2c94177637e258463afe9540deeeac46b8285fa921ed08288797885afa
Opcode Fuzzy Hash: 2806fa42b057277d932b817fcd0406b86e3b74e3c67680df67975127122c3356
Instruction Fuzzy Hash: 1BC12372D40209AFDB20DFA8CC42FEE77F8AF49704F158565FA08EB283D67499419768

Function 00060531 Relevance: 18.0, APIs: 6, Strings: 4, Instructions: 462stringregistryCOMMON

Download Yara Rule

APIs

Part of subcall function 000603E6: CharNextW.USER32(00000000,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006041B
Part of subcall function 000603E6: CharNextW.USER32(00000000,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006043A
Part of subcall function 000603E6: CharNextW.USER32(00000027,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 00060450
Part of subcall function 000603E6: CharNextW.USER32(00000027,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006045B
Part of subcall function 000603E6: CharNextW.USER32(?,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 000604B8

lstrcmpiW.KERNEL32(?,Delete,?,0892D875,?,00000000,00000000,?,000852D6,000000FF,?,00060CE1,?,00000000,00000000,00000000), ref: 000605C8
lstrcmpiW.KERNEL32(?,ForceRemove,?,00000000,00000000,?,000852D6,000000FF,?,00060CE1,?,00000000,00000000,00000000,?), ref: 000605D9
lstrcmpiW.KERNEL32(?,NoRemove,?,?,00000000,00000000,?,000852D6,000000FF,?,00060CE1,?,00000000,00000000,00000000,?), ref: 000606B7
RegDeleteValueW.ADVAPI32(?,?,?,00000000,00020006), ref: 000607F6
RegCloseKey.ADVAPI32(?,?,?,?), ref: 00060A32

Part of subcall function 000602A6: RegQueryInfoKeyW.ADVAPI32(?,00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,00000000,?,?,?,00060A23), ref: 000602CC

Part of subcall function 0006019C: lstrcmpiW.KERNEL32(?,000974F0,00000000,?,000609EC,?,?,?,?), ref: 000601AA

Part of subcall function 000601CB: RegEnumKeyExW.ADVAPI32(?,00000000,?,00000100,00000000,00000000,00000000,?,?,?,?,00000002,00000000,?), ref: 00060254
Part of subcall function 000601CB: RegCloseKey.ADVAPI32(?), ref: 0006026C

lstrcmpiW.KERNEL32(?,Val,?,00000000,00000000,?,000852D6,000000FF,?,00060CE1,?,00000000,00000000,00000000,?), ref: 000606E5

Part of subcall function 00052397: RegCloseKey.ADVAPI32(?,80000002,00052375,?,?,?,?,?,00051253,80000002,SOFTWARE\Microsoft\NET Framework Setup\NDP\v4\Full), ref: 000523A2

Strings

Delete, xrefs: 000605BC
NoRemove, xrefs: 000606B1
ForceRemove, xrefs: 000605D0
Val, xrefs: 000606DF

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CharNextlstrcmpi$Close$DeleteEnumInfoQueryValue
String ID: Delete$ForceRemove$NoRemove$Val
API String ID: 3404352402-1781481701
Opcode ID: 01bdac09bf9f8edb315eebefa5c4b2a7ea6cf3892a53e5c2ef40284fce89efb8
Instruction ID: 3753f2729668aacfc9af2249614a268314c71bb908c524e06f4459eed29a7380
Opcode Fuzzy Hash: 01bdac09bf9f8edb315eebefa5c4b2a7ea6cf3892a53e5c2ef40284fce89efb8
Instruction Fuzzy Hash: 04F1A371D40639ABCF35ABA4CC59AEFB7B6AF44304F0041A5A80AE7251EB749F85CF50

Function 0005DC16 Relevance: 17.8, APIs: 8, Strings: 2, Instructions: 275COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005DC1D
_strcspn.LIBCMT ref: 0005DC88
_strcspn.LIBCMT ref: 0005DCA8
std::locale::locale.LIBCPMT ref: 0005DCB9
std::locale::~locale.LIBCPMT ref: 0005DCD5
ctype.LIBCPMT ref: 0005DD14
std::locale::locale.LIBCPMT ref: 0005DD1F
std::locale::~locale.LIBCPMT ref: 0005DD3E

Strings

@k, xrefs: 0005DC67
<k, xrefs: 0005DC5D

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _strcspnstd::locale::localestd::locale::~locale$H_prolog3_ctype
String ID: <k$@k
API String ID: 675676370-1033056977
Opcode ID: cea7641b0d4110a4d28a7d49b9f0018acaab84df952791331e93d3eef9ef5539
Instruction ID: 69ecd06bdeb2f18430e382e872dabe6c450ec03b7a918d1e1cf5016354fc6651
Opcode Fuzzy Hash: cea7641b0d4110a4d28a7d49b9f0018acaab84df952791331e93d3eef9ef5539
Instruction Fuzzy Hash: 0FB14A71D00249DFDF25DFA8C891AEEBBB6EF18301F14405AEC15AB252D7709E49DBA0

Function 00081FBA Relevance: 17.8, APIs: 9, Strings: 1, Instructions: 272COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00081C88: CreateFileW.KERNEL32(00000000,00000000,?,00082063,?,?,00000000,?,00082063,00000000,0000000C), ref: 00081CA5

GetLastError.KERNEL32 ref: 000820CE
__dosmaperr.LIBCMT ref: 000820D5
GetFileType.KERNEL32(00000000), ref: 000820E1
GetLastError.KERNEL32 ref: 000820EB
__dosmaperr.LIBCMT ref: 000820F4
CloseHandle.KERNEL32(00000000), ref: 00082114
CloseHandle.KERNEL32(?), ref: 0008225E
GetLastError.KERNEL32 ref: 00082290
__dosmaperr.LIBCMT ref: 00082297

Strings

H, xrefs: 0008221C

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast__dosmaperr$CloseFileHandle$CreateType
String ID: H
API String ID: 4237864984-2852464175
Opcode ID: be7e25fcfed69970f62b51f0811403f2b654f762ea18a1a44c732794da021b4a
Instruction ID: ddc3fa1d0bec3cd6d4d593fbca10b670de167ab76c2995c7f221cba3b5dc545a
Opcode Fuzzy Hash: be7e25fcfed69970f62b51f0811403f2b654f762ea18a1a44c732794da021b4a
Instruction Fuzzy Hash: 03A12332A101448FDF19EF68DC957AE7BE5BF06324F24015AE851AB2A2CB359C42CB52

Function 0006C322 Relevance: 16.6, APIs: 11, Instructions: 116COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(337E0000,00000000,?,000000FF,00000000,00000000,?,?,?,?,00059DE7,?,00000032,%Y-%m-%d %H:%M:%S> ,00000000,0005C7FA), ref: 0006C37A
GetLastError.KERNEL32(?,?,?,00059DE7,?,00000032,%Y-%m-%d %H:%M:%S> ,00000000,0005C7FA,?,00000000), ref: 0006C387
__dosmaperr.LIBCMT ref: 0006C38E
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?,00000000,?,?,?,00059DE7,?,00000032,%Y-%m-%d %H:%M:%S> ,00000000,0005C7FA), ref: 0006C3BA
GetLastError.KERNEL32(?,?,?,00059DE7,?,00000032,%Y-%m-%d %H:%M:%S> ,00000000,0005C7FA,?,00000000), ref: 0006C3C4
__dosmaperr.LIBCMT ref: 0006C3CB
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,000000FF,?,00000032,00000000,00000000,?,?,?,?,?,?,?,00059DE7), ref: 0006C40E
GetLastError.KERNEL32(?,?,?,?,?,?,?,00059DE7,?,00000032,%Y-%m-%d %H:%M:%S> ,00000000,0005C7FA,?,00000000), ref: 0006C418
__dosmaperr.LIBCMT ref: 0006C41F
_free.LIBCMT ref: 0006C42B
_free.LIBCMT ref: 0006C432

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ByteCharErrorLastMultiWide__dosmaperr$_free
String ID:
API String ID: 2441525078-0
Opcode ID: fb275050171fc0783ca6f0f06a9ce15e8bd065fdb93346d3e1c769224fc46581
Instruction ID: 7b8d3203f639b8304b6e983ebe01d1e7bd08e0224d1fb5aefc0778e0290f6c2c
Opcode Fuzzy Hash: fb275050171fc0783ca6f0f06a9ce15e8bd065fdb93346d3e1c769224fc46581
Instruction Fuzzy Hash: 4731937280020AEFEF11AFA5DC45DBF7BAAEF55324B148214F85456292DF358E10DBA1

Function 00055DC1 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 212filetimeCOMMON

Download Yara Rule

APIs

wsprintfW.USER32 ref: 00055F39
wsprintfW.USER32 ref: 00055F58
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000002,00000010,00000000), ref: 00055F87
WriteFile.KERNEL32(?,?,00000000,?,00000000), ref: 00056005
SetFileTime.KERNEL32(?,?,?,?), ref: 00056045
CloseHandle.KERNEL32(?), ref: 00056058

Strings

%s%s%s, xrefs: 00055F33
:, xrefs: 00055F14
%s%s, xrefs: 00055F52

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: File$wsprintf$CloseCreateHandleTimeWrite
String ID: %s%s$%s%s%s$:
API String ID: 1593831391-3034790606
Opcode ID: afde44058eab3867d8a49497eb44e3514109c769e0cf03fe831656c19337c572
Instruction ID: f125763c258eef0577aa5a9a25e494f45009c917330dec8dc053cd2562ea416a
Opcode Fuzzy Hash: afde44058eab3867d8a49497eb44e3514109c769e0cf03fe831656c19337c572
Instruction Fuzzy Hash: DE71F371A00A089BDB34DB24CC99BEB73B5BF44303F5005A9EA5A97181DB719E89CB50

Function 0005FC40 Relevance: 15.4, APIs: 10, Instructions: 357registrystringCOMMON

Download Yara Rule

APIs

Part of subcall function 000603E6: CharNextW.USER32(00000000,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006041B
Part of subcall function 000603E6: CharNextW.USER32(00000000,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006043A
Part of subcall function 000603E6: CharNextW.USER32(00000027,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 00060450
Part of subcall function 000603E6: CharNextW.USER32(00000027,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006045B
Part of subcall function 000603E6: CharNextW.USER32(?,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 000604B8

lstrcmpiW.KERNEL32(?,00097404,?,0892D875,?,00000000,?,?,?,00085296,000000FF,?,000608B6,?,00000000,?), ref: 0005FCBD
lstrcmpiW.KERNEL32(?,00097408,?,000608B6,?,00000000,?,?,?,?,0002001F,?,00000000,00000000,?,000852D6), ref: 0005FCD7
CharNextW.USER32(00000000), ref: 0005FE21
CharNextW.USER32(00000000), ref: 0005FE4B
RegSetValueExW.ADVAPI32(?,?,00000000,00000007,?,00000000), ref: 0005FEBC
VarUI4FromStr.OLEAUT32(?,00000000,00000000,?), ref: 0005FEFF
RegSetValueExW.ADVAPI32(?,?,00000000,00000004,?,00000004,?,000608B6,?,00000000,?,?,?,?,0002001F), ref: 0005FF33

Part of subcall function 000603E6: CharNextW.USER32(00000000,00000000,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 000604CD

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CharNext$Valuelstrcmpi$From
String ID:
API String ID: 806832092-0
Opcode ID: 536d9b2577ecf46bcdaa6f355b3b26907b8f879ccd9fdf2614aa3591893c9f0d
Instruction ID: c4692a4fa7ff8f2cce6f1ea5a526f437fbba4fa34e61ec61f28b79a14e63cfa0
Opcode Fuzzy Hash: 536d9b2577ecf46bcdaa6f355b3b26907b8f879ccd9fdf2614aa3591893c9f0d
Instruction Fuzzy Hash: 8AD1E471A40219CBDB35DB24CC49AEFB7BAAF18300F1041AAEA49E7251D7349F98DF50

Function 00073C31 Relevance: 15.1, APIs: 10, Instructions: 54COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00073C45

Part of subcall function 00073E7A: HeapFree.KERNEL32(00000000,00000000,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?), ref: 00073E90
Part of subcall function 00073E7A: GetLastError.KERNEL32(?,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?,?), ref: 00073EA2

_free.LIBCMT ref: 00073C51
_free.LIBCMT ref: 00073C5C
_free.LIBCMT ref: 00073C67
_free.LIBCMT ref: 00073C72
_free.LIBCMT ref: 00073C7D
_free.LIBCMT ref: 00073C88
_free.LIBCMT ref: 00073C93
_free.LIBCMT ref: 00073C9E
_free.LIBCMT ref: 00073CAC

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 6579c142fbd278da7890847141913139105907b877294b1d68cec8789496e115
Instruction ID: d0121107da3db8d86158ce2a8835352a307a153b14a4772246494c6f58cc8096
Opcode Fuzzy Hash: 6579c142fbd278da7890847141913139105907b877294b1d68cec8789496e115
Instruction Fuzzy Hash: 5A117476910108FFEB05EF94C952ED93FA5EF04390B51C0A5FA0C8B272DA35DB51AB84

Function 00059D9D Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 109COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00059DA7
_strftime.LIBCMT ref: 00059DE2
std::ios_base::_Ios_base_dtor.LIBCPMT ref: 00059F21

Part of subcall function 00063F3A: EnterCriticalSection.KERNEL32(0009DCF4,00000000,?,?,00059E0A,0009E65C,?,?,?,?,0005C7FA,?,00000000), ref: 00063F45
Part of subcall function 00063F3A: LeaveCriticalSection.KERNEL32(0009DCF4,?,?,00059E0A,0009E65C,?,?,?,?,0005C7FA,?,00000000), ref: 00063F82

Part of subcall function 00059C99: __EH_prolog3_GS.LIBCMT ref: 00059CA3

Part of subcall function 00064297: __onexit.LIBCMT ref: 0006429D

Part of subcall function 00063EF0: EnterCriticalSection.KERNEL32(0009DCF4,?,?,00059E31,0009E65C,?,?,?,?,0005C7FA,?,00000000), ref: 00063EFA
Part of subcall function 00063EF0: LeaveCriticalSection.KERNEL32(0009DCF4,?,?,00059E31,0009E65C,?,?,?,?,0005C7FA,?,00000000), ref: 00063F2D

Strings

`, xrefs: 00059E5E
\, xrefs: 00059DFF
Setup: , xrefs: 00059EAC
%Y-%m-%d %H:%M:%S> , xrefs: 00059DD7
h, xrefs: 00059E84

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CriticalSection$EnterH_prolog3_Leave$Ios_base_dtor__onexit_strftimestd::ios_base::_
String ID: %Y-%m-%d %H:%M:%S> $Setup: $\$`$h
API String ID: 980613400-1774308099
Opcode ID: 82ec31fdfb0bafcc2cb2adfd71314b546dc0441646428b327ec1d5b934143b61
Instruction ID: 321eabc5138dfc4f620f280a8d49d639402a69a0d9d2230a7fc45cfe10f020c2
Opcode Fuzzy Hash: 82ec31fdfb0bafcc2cb2adfd71314b546dc0441646428b327ec1d5b934143b61
Instruction Fuzzy Hash: 7241A070A00208DFDB10EB64C846EEE77B9FB54704F1045AAE8499B283DF75AE85CF50

Function 00078015 Relevance: 13.8, APIs: 9, Instructions: 300COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 05b81a18e21770614bd77497e8c67d87e774bd03574c028d9c52214e38626cf5
Instruction ID: e48a486c4bdc2c1feb8531e938dbbee2802b0f64a8249a2ce227f44ec8d47aab
Opcode Fuzzy Hash: 05b81a18e21770614bd77497e8c67d87e774bd03574c028d9c52214e38626cf5
Instruction Fuzzy Hash: 19C1E270E44249AFDF11DFA8C849BADBBB1BF09310F14C195E958A7393CB389941CB69

Function 000814C6 Relevance: 13.8, APIs: 9, Instructions: 268COMMON

Download Yara Rule

APIs

GetCPInfo.KERNEL32(00000000,00000001,?,7FFFFFFF,?,?,0008179F,00000000,00000000,?,00000001,?,?,?,?,00000001), ref: 00081572
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000001,00000000,00000000,?,0008179F,00000000,00000000,?,00000001,?,?,?,?), ref: 000815F5
__alloca_probe_16.LIBCMT ref: 0008162D
MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000001,00000000,0008179F,?,0008179F,00000000,00000000,?,00000001,?,?,?,?), ref: 00081688
__alloca_probe_16.LIBCMT ref: 000816D7
MultiByteToWideChar.KERNEL32(00000000,00000009,00000000,00000000,00000000,00000000,?,0008179F,00000000,00000000,?,00000001,?,?,?,?), ref: 0008169F

Part of subcall function 00073EB4: HeapAlloc.KERNEL32(00000000,?,?,?,00074CCA,00001000,?,?,0006BBE0,?,00069909), ref: 00073EE6

MultiByteToWideChar.KERNEL32(00000000,00000001,00000000,00000000,00000000,00000000,?,0008179F,00000000,00000000,?,00000001,?,?,?,?), ref: 0008171B
__freea.LIBCMT ref: 00081746
__freea.LIBCMT ref: 00081752

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ByteCharMultiWide$__alloca_probe_16__freea$AllocHeapInfo
String ID:
API String ID: 3256262068-0
Opcode ID: e2eb3237e60e6bc8a9efe2ca5dbe9fe267d793602fc572dc53a93fd2374f5e95
Instruction ID: ef06c3225302e5fb4d38c4b1a2552253cb5f0059e3a1d74f4bb22824eb4ff495
Opcode Fuzzy Hash: e2eb3237e60e6bc8a9efe2ca5dbe9fe267d793602fc572dc53a93fd2374f5e95
Instruction Fuzzy Hash: 9491A372E046169EDF20AE64C885EEEBBFDBF49710F144529E885E7141DB35DC42CBA0

Function 0007CCA3 Relevance: 13.7, APIs: 9, Instructions: 209COMMON

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 0007CCCA
_free.LIBCMT ref: 0007CD35
_free.LIBCMT ref: 0007CD5B
_free.LIBCMT ref: 0007CD84
_free.LIBCMT ref: 0007CDBC
_free.LIBCMT ref: 0007CDED
_free.LIBCMT ref: 0007CE2E
SetEnvironmentVariableA.KERNEL32(00000000,00000000), ref: 0007CEAF
_free.LIBCMT ref: 0007CEC8

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$EnvironmentVariable___from_strstr_to_strchr
String ID:
API String ID: 1282221369-0
Opcode ID: 5cd87cc9f90b7973988857d59738f980e43a5d87e27200617290be1b3f5990b2
Instruction ID: ed93067653a67bee5edc337245c6aac278cc3a8b73cad0ab7bff4e785cc0d9ae
Opcode Fuzzy Hash: 5cd87cc9f90b7973988857d59738f980e43a5d87e27200617290be1b3f5990b2
Instruction Fuzzy Hash: 2B61F172D00241AFFB35AF64D841EAA7FE4AB05320F04C67EE94D97282D7399D018759

Function 00072AF8 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 266COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00073D25: GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
Part of subcall function 00073D25: _free.LIBCMT ref: 00073D5C
Part of subcall function 00073D25: SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

_memcmp.LIBVCRUNTIME ref: 00072DA2
_free.LIBCMT ref: 00072E13
_free.LIBCMT ref: 00072E2C
_free.LIBCMT ref: 00072E5E
_free.LIBCMT ref: 00072E67
_free.LIBCMT ref: 00072E73

Strings

C, xrefs: 00072C60

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$ErrorLast$_memcmp
String ID: C
API String ID: 4275183328-1037565863
Opcode ID: a712bd5cbf96b384e6c3dbd905725c494b0d284e895561bc24611d3d08a8f14f
Instruction ID: 986dc48bcf35379515069c0c7299826c04035049ebf28cc60f1bc5bf29caab81
Opcode Fuzzy Hash: a712bd5cbf96b384e6c3dbd905725c494b0d284e895561bc24611d3d08a8f14f
Instruction Fuzzy Hash: 19B12775E0121A9FDB64DF28C884AADB7B4FF18304F1085AAE94DA7351E735AE90CF44

Function 0005D8FB Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 243COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005D902
std::locale::locale.LIBCPMT ref: 0005D966
std::locale::~locale.LIBCPMT ref: 0005D982
ctype.LIBCPMT ref: 0005D9C1
std::locale::locale.LIBCPMT ref: 0005D9CC
std::locale::~locale.LIBCPMT ref: 0005D9EB

Strings

(k, xrefs: 0005DB56, 0005DB5C

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::locale::localestd::locale::~locale$H_prolog3_ctype
String ID: (k
API String ID: 2418032536-919258242
Opcode ID: e331bdd1c3061dd3719aae9c9a9e17b35f55c89171b31cab6888a853735b85cd
Instruction ID: 05ef2e297967cab7b95f13f6d56287e937f107fb2934067341ae41b92bde2f2a
Opcode Fuzzy Hash: e331bdd1c3061dd3719aae9c9a9e17b35f55c89171b31cab6888a853735b85cd
Instruction Fuzzy Hash: 7FA15C71D00149DFDF25DFA8C881AEEBBB9EF08301F14805AEC55AB252D7349E49DBA1

Function 000517F0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 71COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 00051884

Strings

A reboot is required following .NET installation - reboot then run installer again., xrefs: 00051804
Cancel, xrefs: 0005185E
@C, xrefs: 0005186F
Restart Now, xrefs: 0005184F
Restart System, xrefs: 00051868
`D, xrefs: 0005187D

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ActiveWindow
String ID: @C$A reboot is required following .NET installation - reboot then run installer again.$Cancel$Restart Now$Restart System$`D
API String ID: 2558294473-293193855
Opcode ID: 2a21e0aad207a0338bf984f00761cc8dcf5ea66bba19c82767f7e1684765c1b7
Instruction ID: 2a5bbba3e9210de26d89e23640bc5efbf5b328f8e037e90effd387ecd973f658
Opcode Fuzzy Hash: 2a21e0aad207a0338bf984f00761cc8dcf5ea66bba19c82767f7e1684765c1b7
Instruction Fuzzy Hash: 35216571D04309ABEB24DFA4D806BEFB7F4EF04316F20411EB915AB182DB745A4C8B95

Function 0007994F Relevance: 12.2, APIs: 8, Instructions: 216COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000001,00000000,?,?,00000000,00000000,?,0006B021,0006B021,?,?,?,00079BA0,00000001,00000001,A4E85006), ref: 000799A9
__alloca_probe_16.LIBCMT ref: 000799E1
MultiByteToWideChar.KERNEL32(00000001,00000001,?,?,00000000,?,?,?,?,00079BA0,00000001,00000001,A4E85006,?,?,?), ref: 00079A2F
__alloca_probe_16.LIBCMT ref: 00079AC6
WideCharToMultiByte.KERNEL32(00000001,00000000,00000000,00000000,?,A4E85006,00000000,00000000,?,00000400,00000000,?,00000000,00000000,00000000,00000000), ref: 00079B29
__freea.LIBCMT ref: 00079B36

Part of subcall function 00073EB4: HeapAlloc.KERNEL32(00000000,?,?,?,00074CCA,00001000,?,?,0006BBE0,?,00069909), ref: 00073EE6

__freea.LIBCMT ref: 00079B3F
__freea.LIBCMT ref: 00079B64

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ByteCharMultiWide__freea$__alloca_probe_16$AllocHeap
String ID:
API String ID: 2597970681-0
Opcode ID: bf4a1ebd1fbded1f49e1c3d58b3653c8197a2c98eee62b48f3596df1f17679c6
Instruction ID: b2be99d2fcff1d17384946343aa75fea06b7ea475746bce99a6b2febc4ba6ca2
Opcode Fuzzy Hash: bf4a1ebd1fbded1f49e1c3d58b3653c8197a2c98eee62b48f3596df1f17679c6
Instruction Fuzzy Hash: B551E372A10216AFEB258FA4DD81EFF77AAEB40710F158629FC0CD6141EB78DC40C6A4

Function 0007DA50 Relevance: 10.7, APIs: 7, Instructions: 204COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 0007DABF
_free.LIBCMT ref: 0007DACD
_free.LIBCMT ref: 0007DBFB
_free.LIBCMT ref: 0007DC06

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a525fd82405420c955b448ef8c32f6c46c2fced6b47fd63ece46314de391c70f
Instruction ID: 6bafbd1c6670846077fec9cf2f76a7f086bfc8c21c1b12aa1a7d227a70ce54d4
Opcode Fuzzy Hash: a525fd82405420c955b448ef8c32f6c46c2fced6b47fd63ece46314de391c70f
Instruction Fuzzy Hash: 2361CE71D00205EFEB20DF68C841B9ABBF5FF45310F15856AE848EB282D778AD41DB98

Function 0005F088 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 182COMMON

Download Yara Rule

APIs

Part of subcall function 00051CED: InitializeCriticalSectionEx.KERNEL32(00000008,00000000,00000000,00000000,00051CA4,00000014,000515FA), ref: 00051CF3
Part of subcall function 00051CED: GetLastError.KERNEL32 ref: 00051CFD

GetModuleFileNameW.KERNEL32(00050000,?,00000104), ref: 0005F14F
GetModuleHandleW.KERNEL32(00000000), ref: 0005F1A3

Strings

Module_Raw, xrefs: 0005F254
Module, xrefs: 0005F234
@q, xrefs: 0005F108, 0005F10E
REGISTRY, xrefs: 0005F282

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: Module$CriticalErrorFileHandleInitializeLastNameSection
String ID: @q$Module$Module_Raw$REGISTRY
API String ID: 3798416324-62667570
Opcode ID: 3e6c7ef4abc156878a34d4cb11e72dc7304869b77a4440f96a6f36aa81a62c6d
Instruction ID: cae87804334f3e48f7fa2c9548ea247e286758cf1be650930dae1f3df27a0939
Opcode Fuzzy Hash: 3e6c7ef4abc156878a34d4cb11e72dc7304869b77a4440f96a6f36aa81a62c6d
Instruction Fuzzy Hash: EC51A672A0061EDBDB24DB64DC41AFB73B8AF49301F1400A9ED0697641EB39AF88CF55

Function 00059F79 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 155registryCOMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00059F83
RegOpenKeyExW.ADVAPI32(80000002,?,00000000), ref: 00059FD1

Part of subcall function 00059BDF: __EH_prolog3.LIBCMT ref: 00059BE6

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?,0h), ref: 0005A039
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,00000000,?), ref: 0005A09D
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,?), ref: 0005A0DA

Strings

0h, xrefs: 00059FF2, 00059FFE

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: QueryValue$H_prolog3H_prolog3_Open
String ID: 0h
API String ID: 2092072835-265446793
Opcode ID: 59103430ae423ba0def7345d808e5286cb8b50bc8da98521213eefaea382957b
Instruction ID: 65952f33a6636487439cb135f875ffecc310467f9941680a8ea24bb5a5e63393
Opcode Fuzzy Hash: 59103430ae423ba0def7345d808e5286cb8b50bc8da98521213eefaea382957b
Instruction Fuzzy Hash: 7F512871A00219DFDF25DF94CC85BEEBBB8FF05305F1042AAE849A6241EB709E49CB51

Function 000766B8 Relevance: 10.7, APIs: 7, Instructions: 152fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetConsoleCP.KERNEL32(FF8BC35D,00000000,?,?,?,?,?,?,?,00076E2D,?,00000000,FF8BC35D,00000000,00000000,FF8BC369), ref: 000766FA
__fassign.LIBCMT ref: 00076775
__fassign.LIBCMT ref: 00076790
WideCharToMultiByte.KERNEL32(?,00000000,00000000,00000001,FF8BC35D,00000005,00000000,00000000), ref: 000767B6
WriteFile.KERNEL32(?,FF8BC35D,00000000,00076E2D,00000000,?,?,?,?,?,?,?,?,?,00076E2D,?), ref: 000767D5
WriteFile.KERNEL32(?,?,00000001,00076E2D,00000000,?,?,?,?,?,?,?,?,?,00076E2D,?), ref: 0007680E

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: FileWrite__fassign$ByteCharConsoleMultiWide
String ID:
API String ID: 1324828854-0
Opcode ID: 4c0b474d7e3ce83863f5decf703db439984adc431df20cfb4ddcce69229d160d
Instruction ID: eca40db64d4164493587f1f42e80661f5dbcd6d44c8a400837ab92c46c516039
Opcode Fuzzy Hash: 4c0b474d7e3ce83863f5decf703db439984adc431df20cfb4ddcce69229d160d
Instruction Fuzzy Hash: 8151A3B0D006499FDF10CFA8D885AEEBBF5FF09300F14811AE95AE7292D735A950CB65

Function 00067370 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 117COMMON

Download Yara Rule

APIs

_ValidateLocalCookies.LIBCMT ref: 0006739B
___except_validate_context_record.LIBVCRUNTIME ref: 000673A3
_ValidateLocalCookies.LIBCMT ref: 00067431
__IsNonwritableInCurrentImage.LIBCMT ref: 0006745C
_ValidateLocalCookies.LIBCMT ref: 000674B1

Strings

csm, xrefs: 00067446

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CookiesLocalValidate$CurrentImageNonwritable___except_validate_context_record
String ID: csm
API String ID: 1170836740-1018135373
Opcode ID: dd15041909ebc9fb56a7dbe7a03ee62c226706140a20be5a604ce8d5da78ff99
Instruction ID: 7346abc3f90eac95e8a989d3813be106f7995ae62be2f2ca29dc1db20d589be3
Opcode Fuzzy Hash: dd15041909ebc9fb56a7dbe7a03ee62c226706140a20be5a604ce8d5da78ff99
Instruction Fuzzy Hash: 9641C330E142199BCF10EF68C844AEEBFF6BF44328F148155E9195B392DB76DA11CB91

Function 00083541 Relevance: 10.6, APIs: 7, Instructions: 80COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7743638708f4f3db3036933091a9fa938e283f8778ed69927f8f6c901f411f6
Instruction ID: 7d31fd2567a2807e8b62213c6f7685ef55818ad3de64d0f592f0195c209a8867
Opcode Fuzzy Hash: f7743638708f4f3db3036933091a9fa938e283f8778ed69927f8f6c901f411f6
Instruction Fuzzy Hash: 8D1121B2505615BBDB213F76DC0ADAB7AACFFD2B30B108214F855D6282DE358A008770

Function 0007DF25 Relevance: 10.6, APIs: 7, Instructions: 65COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 0007DC6C: _free.LIBCMT ref: 0007DC95

_free.LIBCMT ref: 0007DF73

Part of subcall function 00073E7A: HeapFree.KERNEL32(00000000,00000000,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?), ref: 00073E90
Part of subcall function 00073E7A: GetLastError.KERNEL32(?,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?,?), ref: 00073EA2

_free.LIBCMT ref: 0007DF7E
_free.LIBCMT ref: 0007DF89
_free.LIBCMT ref: 0007DFDD
_free.LIBCMT ref: 0007DFE8
_free.LIBCMT ref: 0007DFF3
_free.LIBCMT ref: 0007DFFE

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 392242950af421741d6ec7c06f99aff5f8319de47e3e4fd68862a8d369c3b0d0
Instruction ID: 527b0cf654260b7cb9d071544f3394d398c873e54c9b70975726506ef253859d
Opcode Fuzzy Hash: 392242950af421741d6ec7c06f99aff5f8319de47e3e4fd68862a8d369c3b0d0
Instruction Fuzzy Hash: 71111F71D40B04AAE931BBB0DD47FCB7BAC6F04700F408816B29E67593DAB9F5049694

Function 00061378 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0006137F
std::_Lockit::_Lockit.LIBCPMT ref: 00061389

Part of subcall function 00058FE9: std::_Lockit::_Lockit.LIBCPMT ref: 00059005
Part of subcall function 00058FE9: std::_Lockit::~_Lockit.LIBCPMT ref: 00059021

std::locale::_Getfacet.LIBCPMT ref: 000613A9
codecvt.LIBCPMT ref: 000613C3
std::_Facet_Register.LIBCPMT ref: 000613DA
std::_Lockit::~_Lockit.LIBCPMT ref: 000613FA
__CxxThrowException@8.LIBVCRUNTIME ref: 00061418

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3RegisterThrowcodecvtstd::locale::_
String ID:
API String ID: 1243920060-0
Opcode ID: f2853e0a8ce49fe18811f089607f8e9db11c22cce59ef06e27e0241a1b705c8e
Instruction ID: 82febeb3d9f115a6119f12c056060e0e2fdbbf0774de01fac4e3dd8eb0cbf39f
Opcode Fuzzy Hash: f2853e0a8ce49fe18811f089607f8e9db11c22cce59ef06e27e0241a1b705c8e
Instruction Fuzzy Hash: C611C2769009199BCF05EBA4D8469FD77B6BF84311F180019E8116B292DF789E05C791

Function 0006C470 Relevance: 9.3, APIs: 6, Instructions: 284COMMON

Download Yara Rule

APIs

__allrem.LIBCMT ref: 0006C5FD
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0006C619
__allrem.LIBCMT ref: 0006C630
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0006C64E
__allrem.LIBCMT ref: 0006C665
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0006C683

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@
String ID:
API String ID: 1992179935-0
Opcode ID: 8c8fecf867ea56b5bdec26576f00f43d6a65106a32273bd63c51ba776d1abe2a
Instruction ID: 7b262a547aba60ab2d097dae990e2fc9327ba09bafe77249fc8a854e975b852e
Opcode Fuzzy Hash: 8c8fecf867ea56b5bdec26576f00f43d6a65106a32273bd63c51ba776d1abe2a
Instruction Fuzzy Hash: 1B811A72A00B069BF724EA68CC42FBE73E6AF54764F14812AF595D7282EB70ED008754

Function 0006E6A4 Relevance: 9.2, APIs: 6, Instructions: 200COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftoe.LIBCMT ref: 0006E6D0
__cftoe.LIBCMT ref: 0006E702

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: __cftoe
String ID:
API String ID: 4189289331-0
Opcode ID: b2018ab31a465e69bea72268d3613a3b59277b45f2e17929ef40804ad822278c
Instruction ID: 5bf2f4820b6078625008f06b5547495c1e78894c7e9edef5584610b4b5e8e13e
Opcode Fuzzy Hash: b2018ab31a465e69bea72268d3613a3b59277b45f2e17929ef40804ad822278c
Instruction Fuzzy Hash: DE51173AD04345ABDB749F68CC45EEE77EAEF49320F204229F81DA6182DF35DE009664

Function 000701BA Relevance: 9.1, APIs: 3, Strings: 2, Instructions: 389COMMONLIBRARYCODE

Download Yara Rule

APIs

__alloca_probe_16.LIBCMT ref: 000702C2
__freea.LIBCMT ref: 0007036C
__freea.LIBCMT ref: 0007038A

Strings

a/p, xrefs: 00070451
am/pm, xrefs: 000703ED

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: __freea$__alloca_probe_16
String ID: a/p$am/pm
API String ID: 3509577899-3206640213
Opcode ID: d0ee459cfab858780fc0c7ce5bbe9195586ef66cfbaa688b9e35cbcf79f9913e
Instruction ID: 0f101cc661f4e7389eb8617e6090560b3a9d279f7b7f8d9076168bc284f3525f
Opcode Fuzzy Hash: d0ee459cfab858780fc0c7ce5bbe9195586ef66cfbaa688b9e35cbcf79f9913e
Instruction Fuzzy Hash: F9D1DE71E10206CADB648F68C895BBFB7B5FF05300F24C359E549AB251D3799E80CBA9

Function 000603E6 Relevance: 9.1, APIs: 6, Instructions: 129COMMON

Download Yara Rule

APIs

CharNextW.USER32(00000000,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006041B
CharNextW.USER32(00000000,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006043A
CharNextW.USER32(00000027,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 00060450
CharNextW.USER32(00000027,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 0006045B
CharNextW.USER32(?,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 000604B8
CharNextW.USER32(00000000,00000000,?,00000000,00000000,?,?,?,00060EAF,00000000,?), ref: 000604CD

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CharNext
String ID:
API String ID: 3213498283-0
Opcode ID: 3f88db6d429ef4ca50e87d466ec5b45e42263b291735aa6e5da79241cdab06dc
Instruction ID: fa36e4541ebd274a51607ec704118b36af601b521e77e1c63d8bfed0120f420e
Opcode Fuzzy Hash: 3f88db6d429ef4ca50e87d466ec5b45e42263b291735aa6e5da79241cdab06dc
Instruction Fuzzy Hash: A641F0747406028BDB64AF78C98467BB7F6EF58300BA4846AEA83C7355EB758E40CB10

Function 0005856E Relevance: 9.1, APIs: 6, Instructions: 68COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00058575
std::_Lockit::_Lockit.LIBCPMT ref: 00058582

Part of subcall function 00058FE9: std::_Lockit::_Lockit.LIBCPMT ref: 00059005
Part of subcall function 00058FE9: std::_Lockit::~_Lockit.LIBCPMT ref: 00059021

std::locale::_Getfacet.LIBCPMT ref: 000585A1
std::_Facet_Register.LIBCPMT ref: 000585D0
std::_Lockit::~_Lockit.LIBCPMT ref: 000585F0
__CxxThrowException@8.LIBVCRUNTIME ref: 0005860E

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowstd::locale::_
String ID:
API String ID: 3429215992-0
Opcode ID: b6e92c133de507fff2f18451edefba4296e108eb81b82019fe1395742410b3bf
Instruction ID: 1df6ad46004c8b4395b922d0391dfa198390f784b4c8e21a09d5696b8bc39de8
Opcode Fuzzy Hash: b6e92c133de507fff2f18451edefba4296e108eb81b82019fe1395742410b3bf
Instruction Fuzzy Hash: 69110A72A045198BCB00EB64D8019FF73B6AF94311F25405AED0577393DF349E058BA1

Function 0005C2F4 Relevance: 9.1, APIs: 6, Instructions: 66COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005C2FB
std::_Lockit::_Lockit.LIBCPMT ref: 0005C308

Part of subcall function 00058FE9: std::_Lockit::_Lockit.LIBCPMT ref: 00059005
Part of subcall function 00058FE9: std::_Lockit::~_Lockit.LIBCPMT ref: 00059021

std::locale::_Getfacet.LIBCPMT ref: 0005C327
std::_Facet_Register.LIBCPMT ref: 0005C356
std::_Lockit::~_Lockit.LIBCPMT ref: 0005C376
__CxxThrowException@8.LIBVCRUNTIME ref: 0005C394

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowstd::locale::_
String ID:
API String ID: 3429215992-0
Opcode ID: c3f54c641a4a7a8f32620443136f8b32736e51146cd9506c9d5b4889b73bac65
Instruction ID: 8794bf0909114d8c9648fb66eea90a42001c326546b95ba29ac66b97598e7902
Opcode Fuzzy Hash: c3f54c641a4a7a8f32620443136f8b32736e51146cd9506c9d5b4889b73bac65
Instruction Fuzzy Hash: 8F11017690420D8BCB00EBA4D802AFEB7BAAF84311F244019E80167293DF349F058BA1

Function 0006753A Relevance: 9.1, APIs: 6, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,00067531,00064E4B), ref: 00067548
___vcrt_FlsGetValue.LIBVCRUNTIME ref: 00067556
___vcrt_FlsSetValue.LIBVCRUNTIME ref: 0006756F
SetLastError.KERNEL32(00000000,?,00067531,00064E4B), ref: 000675C1

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLastValue___vcrt_
String ID:
API String ID: 3852720340-0
Opcode ID: d4af0e4cf9529f3596d57ee6efaa7675b6b5e456653f52752de3a61f09e9803d
Instruction ID: 5a2935506237fca45abe28762e05587045118890ba96984d513145327228b030
Opcode Fuzzy Hash: d4af0e4cf9529f3596d57ee6efaa7675b6b5e456653f52752de3a61f09e9803d
Instruction Fuzzy Hash: E1014C3250DB119EF6642774BC89AAB27C6FB4277C770036BF11E410E2FF914C109284

Function 0005E13C Relevance: 9.1, APIs: 6, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005E143
std::_Lockit::_Lockit.LIBCPMT ref: 0005E150

Part of subcall function 00058FE9: std::_Lockit::_Lockit.LIBCPMT ref: 00059005
Part of subcall function 00058FE9: std::_Lockit::~_Lockit.LIBCPMT ref: 00059021

std::locale::_Getfacet.LIBCPMT ref: 0005E16F
std::_Facet_Register.LIBCPMT ref: 0005E19E
std::_Lockit::~_Lockit.LIBCPMT ref: 0005E1BE
__CxxThrowException@8.LIBVCRUNTIME ref: 0005E1DC

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowstd::locale::_
String ID:
API String ID: 3429215992-0
Opcode ID: 3f9656982a6abbaa873dedff430e652f978250f57be29bb30daf77bea53ef328
Instruction ID: d817ee2affcd75546c26cb21affa408a6efdb356f5bcb9e46837936eebe82028
Opcode Fuzzy Hash: 3f9656982a6abbaa873dedff430e652f978250f57be29bb30daf77bea53ef328
Instruction Fuzzy Hash: 2E11E9719005099BCB04EBA4C946AEE77B7AF94311F240019F841BB2D3DF349F0587A1

Function 0005E1E2 Relevance: 9.1, APIs: 6, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005E1E9
std::_Lockit::_Lockit.LIBCPMT ref: 0005E1F6

Part of subcall function 00058FE9: std::_Lockit::_Lockit.LIBCPMT ref: 00059005
Part of subcall function 00058FE9: std::_Lockit::~_Lockit.LIBCPMT ref: 00059021

std::locale::_Getfacet.LIBCPMT ref: 0005E215
std::_Facet_Register.LIBCPMT ref: 0005E244
std::_Lockit::~_Lockit.LIBCPMT ref: 0005E264
__CxxThrowException@8.LIBVCRUNTIME ref: 0005E282

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowstd::locale::_
String ID:
API String ID: 3429215992-0
Opcode ID: 7a01391c18acd9b1f42041eb552ccbac3c82e820e3e0e7c071ab5fc7a810895d
Instruction ID: e2031f865bc2c53f2e53199df897b6f9cb73a9b33f69bff70b4b7f983664d47e
Opcode Fuzzy Hash: 7a01391c18acd9b1f42041eb552ccbac3c82e820e3e0e7c071ab5fc7a810895d
Instruction Fuzzy Hash: B411E536A046098BCF08EBA4D956AEF77BAAF94311F240059E90177293DF349F0987A1

Function 0005BAE3 Relevance: 9.1, APIs: 6, Instructions: 55COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005BAEA
std::_Lockit::_Lockit.LIBCPMT ref: 0005BAF7

Part of subcall function 00058FE9: std::_Lockit::_Lockit.LIBCPMT ref: 00059005
Part of subcall function 00058FE9: std::_Lockit::~_Lockit.LIBCPMT ref: 00059021

std::locale::_Getfacet.LIBCPMT ref: 0005BB16
std::_Facet_Register.LIBCPMT ref: 0005BB45
std::_Lockit::~_Lockit.LIBCPMT ref: 0005BB65
__CxxThrowException@8.LIBVCRUNTIME ref: 0005BB83

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::_$Lockit$Lockit::_Lockit::~_$Exception@8Facet_GetfacetH_prolog3_RegisterThrowstd::locale::_
String ID:
API String ID: 3429215992-0
Opcode ID: 65b5f1f5b6a1d07c3de840514a23e40e955d05f05460a6dbadc985a43c726648
Instruction ID: 4c3f14715d631fe68c42eb2ae539ba9198657777c2321db1e4d5dc872448780b
Opcode Fuzzy Hash: 65b5f1f5b6a1d07c3de840514a23e40e955d05f05460a6dbadc985a43c726648
Instruction Fuzzy Hash: 7D11E9759045098BDF00EFA4D856AEF77B6AF84311F240059F80177293DF74AE058BA1

Function 0005FB5D Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 80registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?,?,?,?,?,0006087E,?,?), ref: 0005FB90
GetProcAddress.KERNEL32(00000000,RegCreateKeyTransactedW), ref: 0005FBA0
RegCreateKeyExW.ADVAPI32(?,0006087E,00000000,00000000,00000000,0002001F,00000000,0006087E,?,?,?,?,?,?,0006087E,?), ref: 0005FBF1

Strings

RegCreateKeyTransactedW, xrefs: 0005FB9A
Advapi32.dll, xrefs: 0005FB8B

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: AddressCreateHandleModuleProc
String ID: Advapi32.dll$RegCreateKeyTransactedW
API String ID: 1964897782-2994018265
Opcode ID: 952de2cc9b66b6859a43ceacae39ebf6a9f4294996f90b16675efb3f8b4cff64
Instruction ID: 7ed46f8ed436bcaf5458fda6a29fba8da52fa311e8268c8f6e7b92fbebac6433
Opcode Fuzzy Hash: 952de2cc9b66b6859a43ceacae39ebf6a9f4294996f90b16675efb3f8b4cff64
Instruction Fuzzy Hash: 3A217FB1A0020AFFEB14DF64CC55EBFB7B8EF88702B10846DB906D6141DB349A04DB61

Function 000563D0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 72COMMON

Download Yara Rule

APIs

GetActiveWindow.USER32 ref: 0005644E
ShellExecuteW.SHELL32(00000000,00000000,?,00000000,00000000,00000005), ref: 00056472

Strings

da, xrefs: 00056409
pa, xrefs: 00056440
Da, xrefs: 00056401

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ActiveExecuteShellWindow
String ID: Da$da$pa
API String ID: 2922113260-762710587
Opcode ID: 914a794251df3415df4b9dc13e89b0f3acfd4fb40e4428c8aed7af355c57c2b6
Instruction ID: 1588cf4e8084656bfcb75ba18a1ca5b059d2d7d50de6f636fb0d5eeb00253fb8
Opcode Fuzzy Hash: 914a794251df3415df4b9dc13e89b0f3acfd4fb40e4428c8aed7af355c57c2b6
Instruction Fuzzy Hash: 73215EB1D00209AFDB24DFA8D8859EFBBF8EF08315F20422EA411A7251EB755908CF60

Function 000522B1 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 46registrylibraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?,80000002,00000000,?,00052354,00000000,?,?,80000002,00000000,?,?,?,?), ref: 000522C4
GetProcAddress.KERNEL32(00000000,RegOpenKeyTransactedW), ref: 000522D4
RegOpenKeyExW.ADVAPI32(00000000,?,00000000,00051253,?,?,80000002,00000000,?,00052354,00000000,?,?,80000002,00000000), ref: 0005230E

Strings

Advapi32.dll, xrefs: 000522BF
RegOpenKeyTransactedW, xrefs: 000522CE

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: AddressHandleModuleOpenProc
String ID: Advapi32.dll$RegOpenKeyTransactedW
API String ID: 1337834000-3913318428
Opcode ID: 8f6561585fb58c68471d197b7334097ee2ca83eda146f1555f5e9f53757cdf02
Instruction ID: e8ed51484fbe4c67722981c0c705146789fdcd3cf066614e0385ec4985ad1162
Opcode Fuzzy Hash: 8f6561585fb58c68471d197b7334097ee2ca83eda146f1555f5e9f53757cdf02
Instruction Fuzzy Hash: 21016972100209FFDF221F90EC44CAB3BAAFF463967054039FA4585021CB768D71EBA1

Function 00060350 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 45libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,00000000,00000000,?,00060A8E,?,?,?,?), ref: 00060378
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00060388

Part of subcall function 000602F1: GetModuleHandleW.KERNEL32(Advapi32.dll,?,00000000,?,?,00060367,?,?,00000000,?,00060A8E,?,?,?,?), ref: 00060304
Part of subcall function 000602F1: GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 00060314

Strings

Advapi32.dll, xrefs: 00060373
RegDeleteKeyExW, xrefs: 00060382

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyExW
API String ID: 1646373207-2191092095
Opcode ID: 313f450bca9ba1e68e6b2a01f30e6ec8051d5722a2724ba2431fdd7397980367
Instruction ID: d7a511bd02f6d6744a6162af18599659f8d96af8e416ab8d169ade76aceb72e4
Opcode Fuzzy Hash: 313f450bca9ba1e68e6b2a01f30e6ec8051d5722a2724ba2431fdd7397980367
Instruction Fuzzy Hash: 5F01D835284260EBEF614F10EC04B5A7F6ABF15752B050016F54566270CBB69D50EB90

Function 00051B05 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(comctl32.dll,?,00000001,?,?,?,00051893,00000000), ref: 00051B24
GetProcAddress.KERNEL32(00000000,TaskDialogIndirect), ref: 00051B36
FreeLibrary.KERNEL32(00000000,?,00000001,?,?,?,00051893,00000000), ref: 00051B59

Strings

comctl32.dll, xrefs: 00051B1A
TaskDialogIndirect, xrefs: 00051B30

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: Library$AddressFreeLoadProc
String ID: TaskDialogIndirect$comctl32.dll
API String ID: 145871493-2809879075
Opcode ID: c2ab4767c4b033effd33bd511a27ac1f1dd974a85b71f6adaf7f3a0bf6b6516e
Instruction ID: f9b21897d7667fa33bbec8e01aa0fff8e76e80e17e163b1c6b3047d10eb0e083
Opcode Fuzzy Hash: c2ab4767c4b033effd33bd511a27ac1f1dd974a85b71f6adaf7f3a0bf6b6516e
Instruction Fuzzy Hash: A7F0C231601615BFE7111B649C08FABBBA8EF05751F014125FD01D7291EBB8DD059AA0

Function 00070D48 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 38libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00000000,?,?,?,00070CF9,0006EC55,?,00070C99,0006EC55,0009A6B0,0000000C,00070DF0,0006EC55,00000002), ref: 00070D68
GetProcAddress.KERNEL32(00000000,CorExitProcess), ref: 00070D7B
FreeLibrary.KERNEL32(00000000,?,?,?,00070CF9,0006EC55,?,00070C99,0006EC55,0009A6B0,0000000C,00070DF0,0006EC55,00000002,00000000), ref: 00070D9E

Strings

CorExitProcess, xrefs: 00070D73
mscoree.dll, xrefs: 00070D61

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: AddressFreeHandleLibraryModuleProc
String ID: CorExitProcess$mscoree.dll
API String ID: 4061214504-1276376045
Opcode ID: 66db39c7cad99ed92070c995295c4c3c06a7bb2049a0371effe44e773cddd2d0
Instruction ID: 7efb998b514e0077379268921d3e69bd5fb411ecd3df4db7bdf0c855441818cc
Opcode Fuzzy Hash: 66db39c7cad99ed92070c995295c4c3c06a7bb2049a0371effe44e773cddd2d0
Instruction Fuzzy Hash: 12F08C30A00208EBDB50AF90DC09B9EBFB8EF04715F014164A849AA1A1CB79AE40CB94

Function 00079E33 Relevance: 7.7, APIs: 5, Instructions: 222COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c85a34f0350ab302fcf580e740d850de43070a5c6bb7221a5e4f7fa7cc122f6f
Instruction ID: fcaaaec99b28c97edaa6e6807cd144286765f0cfdfd6cdf16b27368e3076c7b1
Opcode Fuzzy Hash: c85a34f0350ab302fcf580e740d850de43070a5c6bb7221a5e4f7fa7cc122f6f
Instruction Fuzzy Hash: 1F71C231E012169BCB21CF54C844ABFBBB5FF92310F148629E86997181DB798D41CBE6

Function 0007267A Relevance: 7.7, APIs: 5, Instructions: 187COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00073EB4: HeapAlloc.KERNEL32(00000000,?,?,?,00074CCA,00001000,?,?,0006BBE0,?,00069909), ref: 00073EE6

_free.LIBCMT ref: 00072785
_free.LIBCMT ref: 0007279C
_free.LIBCMT ref: 000727BB
_free.LIBCMT ref: 000727D6
_free.LIBCMT ref: 000727ED

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$AllocHeap
String ID:
API String ID: 1835388192-0
Opcode ID: 7a5b7aa38a57a2f51b480b94397a0c17f2508e5330260bd5b1d5cd26502ed4b5
Instruction ID: 76a73e0af338f272daad23e3d5c7aa0a95fe4ebef3d9f808e39e029109fd3c27
Opcode Fuzzy Hash: 7a5b7aa38a57a2f51b480b94397a0c17f2508e5330260bd5b1d5cd26502ed4b5
Instruction Fuzzy Hash: 8051C071E00705EFDB659F29C941AAA77F4FF58720B10856DE80DDB291EB39DA01CB84

Function 000762B3 Relevance: 7.7, APIs: 5, Instructions: 171timeCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetTimeZoneInformation.KERNEL32(?,00000000,00000000,00000000,?,0008CA00), ref: 0007631D
WideCharToMultiByte.KERNEL32(00000000,00000000,0009E4D4,000000FF,00000000,0000003F,00000000,?,?), ref: 00076395
WideCharToMultiByte.KERNEL32(00000000,00000000,0009E528,000000FF,?,0000003F,00000000,?), ref: 000763C2
_free.LIBCMT ref: 0007630B

Part of subcall function 00073E7A: HeapFree.KERNEL32(00000000,00000000,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?), ref: 00073E90
Part of subcall function 00073E7A: GetLastError.KERNEL32(?,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?,?), ref: 00073EA2

_free.LIBCMT ref: 000764D7

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ByteCharMultiWide_free$ErrorFreeHeapInformationLastTimeZone
String ID:
API String ID: 1286116820-0
Opcode ID: b2ca0a374e6f6aef3f0de684f93da7e47d9c888be64aaf45f2303fe71bcc4b92
Instruction ID: fbf41c2dfe4a658733eeec5735ecb1a656e726370c98cdf7fafc697be1775437
Opcode Fuzzy Hash: b2ca0a374e6f6aef3f0de684f93da7e47d9c888be64aaf45f2303fe71bcc4b92
Instruction Fuzzy Hash: E3513871D00619EBEB10DFA4CC819EEB7F8FF40310B10C26AE559A7292E7799E41CB54

Function 0007176E Relevance: 7.6, APIs: 5, Instructions: 129COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 000717E0
_free.LIBCMT ref: 00071800

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: 52c789948f234a5cbeb9bae3fdf8021cb2236bf5be26b86881e61437c1f924a4
Instruction ID: ed7fdca42968753f689be745078162b1e8ea4f149e479445506b67822d3d73b6
Opcode Fuzzy Hash: 52c789948f234a5cbeb9bae3fdf8021cb2236bf5be26b86881e61437c1f924a4
Instruction Fuzzy Hash: DE41BE32E00204EBDB24DF78C881A99B7F6EF85714F1585A9E519EB382DB35AD01CB85

Function 00079832 Relevance: 7.6, APIs: 5, Instructions: 110COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000000,?,?,00000000,00000000,00073F27,?,00000000,?,00000001,?,?,00000001,00073F27,00000000), ref: 0007987F
__alloca_probe_16.LIBCMT ref: 000798B7
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,?), ref: 00079908
GetStringTypeW.KERNEL32(?,00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,0007304C,?), ref: 0007991A
__freea.LIBCMT ref: 00079923

Part of subcall function 00073EB4: HeapAlloc.KERNEL32(00000000,?,?,?,00074CCA,00001000,?,?,0006BBE0,?,00069909), ref: 00073EE6

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ByteCharMultiWide$AllocHeapStringType__alloca_probe_16__freea
String ID:
API String ID: 1857427562-0
Opcode ID: 512de5efcc18ca4192f7babd4efdcd06007680572b873240b0350fdf94788147
Instruction ID: ab39f8d476ffe9530bbdf437c0284df9bce1ad7e34480d1e288ad299696c7651
Opcode Fuzzy Hash: 512de5efcc18ca4192f7babd4efdcd06007680572b873240b0350fdf94788147
Instruction Fuzzy Hash: 6731CF32E0021AABEF259F64DC45DEE7BA9EB41710F058129FC08DB191EB39CD50CBA0

Function 0007CBD0 Relevance: 7.6, APIs: 5, Instructions: 68COMMON

Download Yara Rule

APIs

GetEnvironmentStringsW.KERNEL32 ref: 0007CBD9
WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 0007CBFC

Part of subcall function 00073EB4: HeapAlloc.KERNEL32(00000000,?,?,?,00074CCA,00001000,?,?,0006BBE0,?,00069909), ref: 00073EE6

WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,00000000,00000000,?,00000000,00000000), ref: 0007CC22
_free.LIBCMT ref: 0007CC35
FreeEnvironmentStringsW.KERNEL32(00000000), ref: 0007CC44

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ByteCharEnvironmentMultiStringsWide$AllocFreeHeap_free
String ID:
API String ID: 2278895681-0
Opcode ID: 4742a1a252b3e604968d858fa8efe0ac16f65aae92f9602cfe3954e9d97d9da7
Instruction ID: fde33b743b9c9b143fb69f4dc6a66db6a9dd331e4d57a0cfada190e73a178a16
Opcode Fuzzy Hash: 4742a1a252b3e604968d858fa8efe0ac16f65aae92f9602cfe3954e9d97d9da7
Instruction Fuzzy Hash: 2F01D472E013587F372256B66C88C7B6BADEFC2B60315822DFD0CC6201DA6D8C0196B9

Function 00073DA9 Relevance: 7.6, APIs: 5, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,?,?,00068D07,0006BBA4,00051D82,00000000,?,00000000,00051817,00000000,?,?,00051817,00000000,A reboot is required following .NET installation - reboot then run installer again.), ref: 00073DAE
_free.LIBCMT ref: 00073DE3
_free.LIBCMT ref: 00073E0A
SetLastError.KERNEL32(00000000,?,00068D07,0006BBA4,00051D82,00000000,?,00000000,00051817,00000000,?,?,00051817,00000000,A reboot is required following .NET installation - reboot then run installer again.), ref: 00073E17
SetLastError.KERNEL32(00000000,?,00068D07,0006BBA4,00051D82,00000000,?,00000000,00051817,00000000,?,?,00051817,00000000,A reboot is required following .NET installation - reboot then run installer again.), ref: 00073E20

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: cd0c755d13a19ddb3597763412d0087af44398d705d9ac6c915b26b5d5eacc51
Instruction ID: ae520c465ade79c55b115ff83d354f8c34a97dbfe499b4161df2720536134152
Opcode Fuzzy Hash: cd0c755d13a19ddb3597763412d0087af44398d705d9ac6c915b26b5d5eacc51
Instruction Fuzzy Hash: 0C01F932D44A0177F62127246C89D9B269DFBC1771725812DF50D962D3EF7D8E01716C

Function 00073D25 Relevance: 7.6, APIs: 5, Instructions: 50COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLastError.KERNEL32(?,0006BBE0,00069863,0006BBE0,?,?,00069920,FF8BC35D), ref: 00073D29
_free.LIBCMT ref: 00073D5C
_free.LIBCMT ref: 00073D84
SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D91
SetLastError.KERNEL32(00000000,FF8BC35D), ref: 00073D9D

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorLast$_free
String ID:
API String ID: 3170660625-0
Opcode ID: bffcd34798331d276ec9c0303684fc9a29e399eff930c64475f26ea7f6f7ffbe
Instruction ID: 96a28863c115ed4b32d65929f71ab8cc36f18e06a5c1232ceeef4a2227c30909
Opcode Fuzzy Hash: bffcd34798331d276ec9c0303684fc9a29e399eff930c64475f26ea7f6f7ffbe
Instruction Fuzzy Hash: 94F0A935D40A0066F63133247C0DF9F2665EBC1761F258118F55C971E3EF6D9E01615D

Function 0007D9DC Relevance: 7.5, APIs: 5, Instructions: 40COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 0007D9F4

Part of subcall function 00073E7A: HeapFree.KERNEL32(00000000,00000000,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?), ref: 00073E90
Part of subcall function 00073E7A: GetLastError.KERNEL32(?,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?,?), ref: 00073EA2

_free.LIBCMT ref: 0007DA06
_free.LIBCMT ref: 0007DA18
_free.LIBCMT ref: 0007DA2A
_free.LIBCMT ref: 0007DA3C

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 5909f0685b38834ea62299b64d3e715fbad3886d8b9a6651ed2030dbffa80b55
Instruction ID: 6b833513e673d00d94c7988ebda0c17d07275a58119e915a5d8d234ffd18eb20
Opcode Fuzzy Hash: 5909f0685b38834ea62299b64d3e715fbad3886d8b9a6651ed2030dbffa80b55
Instruction Fuzzy Hash: 89F0FF32D08204BBF660EB68E481D5677E9BF017107958807F04DD7652CA3CFD80465C

Function 000719F0 Relevance: 7.5, APIs: 5, Instructions: 30COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00071A0E

Part of subcall function 00073E7A: HeapFree.KERNEL32(00000000,00000000,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?), ref: 00073E90
Part of subcall function 00073E7A: GetLastError.KERNEL32(?,?,0007DC9A,?,00000000,?,00000000,?,0007DF3E,?,00000007,?,?,0007E339,?,?), ref: 00073EA2

_free.LIBCMT ref: 00071A20
_free.LIBCMT ref: 00071A33
_free.LIBCMT ref: 00071A44
_free.LIBCMT ref: 00071A55

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 2ad3779ffda6753888deecb34ac30f644577ffaebf7cd765ada8a8796be43622
Instruction ID: e5be8947c52013f8b586a76295e38b17713238539ef7068768403b92b2b332ce
Opcode Fuzzy Hash: 2ad3779ffda6753888deecb34ac30f644577ffaebf7cd765ada8a8796be43622
Instruction Fuzzy Hash: 4CF05871C456A0ABBB51EF28FC0198A3B60FB14B20356950BF44D923F2D73E0E01AF89

Function 00070E43 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 115COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\ProgramData\MSTeamsSetup_c_l_.exe,00000104), ref: 00070E7E
_free.LIBCMT ref: 00070F49
_free.LIBCMT ref: 00070F53

Strings

C:\ProgramData\MSTeamsSetup_c_l_.exe, xrefs: 00070E75, 00070E7C, 00070EAB, 00070EE3

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free$FileModuleName
String ID: C:\ProgramData\MSTeamsSetup_c_l_.exe
API String ID: 2506810119-1495894503
Opcode ID: d70cf8d082df4b78cb2bc083fdb40215df67ea17a562b3f2315beebcb51fe3f9
Instruction ID: d64c27e4f8bef1b2b8e6c2a341276adffdd8df39b278f7f5a9e995411f0c7a87
Opcode Fuzzy Hash: d70cf8d082df4b78cb2bc083fdb40215df67ea17a562b3f2315beebcb51fe3f9
Instruction Fuzzy Hash: 70317A71E00248EFDB31DF99DC81D9EBBF8EB85310B10816AF40897252E6799E40CB95

Function 0005B3DA Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0005B3E1

Part of subcall function 0005B7A3: __EH_prolog3.LIBCMT ref: 0005B7AA
Part of subcall function 0005B7A3: std::locale::_Init.LIBCPMT ref: 0005B7CC

std::locale::locale.LIBCPMT ref: 0005B494

Part of subcall function 0005BAE3: __EH_prolog3_GS.LIBCMT ref: 0005BAEA
Part of subcall function 0005BAE3: std::_Lockit::_Lockit.LIBCPMT ref: 0005BAF7
Part of subcall function 0005BAE3: std::locale::_Getfacet.LIBCPMT ref: 0005BB16
Part of subcall function 0005BAE3: std::_Lockit::~_Lockit.LIBCPMT ref: 0005BB65

std::locale::~locale.LIBCPMT ref: 0005B4B6

Strings

Th, xrefs: 0005B3F6

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: H_prolog3Lockitstd::_std::locale::_$GetfacetH_prolog3_InitLockit::_Lockit::~_std::locale::localestd::locale::~locale
String ID: Th
API String ID: 1052851503-1074529909
Opcode ID: 4130159e7673c98aaaaed09d1cd0bad71fb8193b110c025fd69c5f3642ddeeb1
Instruction ID: 6bf4331215128dda70ee39a9a9ff73d70786d3a71676d398a932a6490ef6383e
Opcode Fuzzy Hash: 4130159e7673c98aaaaed09d1cd0bad71fb8193b110c025fd69c5f3642ddeeb1
Instruction Fuzzy Hash: 1A318CB0A00605DFDB11DF58C985AAEBBF5FF48300F108059E909AB342DB75EE09CB91

Function 00059C99 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 61COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 00059CA3

Strings

\SquirrelTemp\SquirrelSetup.log, xrefs: 00059D3F
LOCALAPPDATA, xrefs: 00059CC2
`, xrefs: 00059CB6

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: H_prolog3_
String ID: LOCALAPPDATA$\SquirrelTemp\SquirrelSetup.log$`
API String ID: 2427045233-2037152474
Opcode ID: 3c1f1dcafd388b886b48a70d4375d81fdd7412b037f2a4ab460ef9498629a17c
Instruction ID: b45dbb539499067ea4b4666f5c9f7025c8c9d00dc48d62086922e0dcb1fd9a02
Opcode Fuzzy Hash: 3c1f1dcafd388b886b48a70d4375d81fdd7412b037f2a4ab460ef9498629a17c
Instruction Fuzzy Hash: 7D215BB190026CDACB21EF54CC85BDEB7B9BB59311F0401EAB909A7242DB385F88CF50

Function 0005EB6E Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(,00000000,00000000,?,?,?,?,0005EAEC,?), ref: 0005EB83
DestroyWindow.USER32(00000000,?,?,?,?,0005EAEC,?), ref: 0005EB9E
LeaveCriticalSection.KERNEL32(,?,?,?,?,0005EAEC,?), ref: 0005EBD3

Strings

, xrefs: 0005EB76, 0005EB7F, 0005EBCC

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CriticalSection$DestroyEnterLeaveWindow
String ID:
API String ID: 1456685395-65463447
Opcode ID: fc67b6bbabcd9a29522f52dddf4727c0dc725142a1d8aa8d830f6394c2cbf9cb
Instruction ID: 05d39af254f270f56a672351bfb1dd3384d7260aa4ca8e55ab38d75827a36887
Opcode Fuzzy Hash: fc67b6bbabcd9a29522f52dddf4727c0dc725142a1d8aa8d830f6394c2cbf9cb
Instruction Fuzzy Hash: 2201FC32801381EFEB209F48E88485BBBF8FF24712B21002FE982A3262C7756D44CF50

Function 000602F1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(Advapi32.dll,?,00000000,?,?,00060367,?,?,00000000,?,00060A8E,?,?,?,?), ref: 00060304
GetProcAddress.KERNEL32(00000000,RegDeleteKeyTransactedW), ref: 00060314

Strings

Advapi32.dll, xrefs: 000602FF
RegDeleteKeyTransactedW, xrefs: 0006030E

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: AddressHandleModuleProc
String ID: Advapi32.dll$RegDeleteKeyTransactedW
API String ID: 1646373207-2168864297
Opcode ID: c978b505a6a36ae3f858c4091a1614f7c4884d13a526f94238e5f36db95c6609
Instruction ID: 4c391d64feb7c561e71026f5910a9e65a5d463f59838f0e7fe3f019922b58fb6
Opcode Fuzzy Hash: c978b505a6a36ae3f858c4091a1614f7c4884d13a526f94238e5f36db95c6609
Instruction Fuzzy Hash: 17F0B473284218EFEB701F94AC8487777EEFB857A6315403AF28889210C7728D419B61

Function 00058ECB Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 41COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBVCRUNTIME ref: 00058F2F

Strings

ios_base::badbit set, xrefs: 00058EED, 00058F12
ios_base::failbit set, xrefs: 00058EF7
ios_base::eofbit set, xrefs: 00058EFC

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: Exception@8Throw
String ID: ios_base::badbit set$ios_base::eofbit set$ios_base::failbit set
API String ID: 2005118841-1866435925
Opcode ID: 565360d3cab7c9ee443735b760c77a11f22ff2e05814f22c823060c26ca9d818
Instruction ID: 9a2752c837470385c8ce3361895c8e0c8aa16d6a720e22642525c34dbeeb1cd4
Opcode Fuzzy Hash: 565360d3cab7c9ee443735b760c77a11f22ff2e05814f22c823060c26ca9d818
Instruction Fuzzy Hash: 95F0C2B2D046087EDF60EA54DC07BEB33E99B14351F14C065EE02BB183EE6AAD498790

Function 00074290 Relevance: 6.3, APIs: 4, Instructions: 305COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 0007431B
__alldvrm.LIBCMT ref: 0007451C
__alldvrm.LIBCMT ref: 0007453E

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: __alldvrm$_strrchr
String ID:
API String ID: 1036877536-0
Opcode ID: b79fce6431be69057aa7f42918c2d2135c873c19bbed57f4db6d95c06a05dec3
Instruction ID: 45dad006d885257a5ef9d35267536268ca9df1bb1050825b8ec2ee8e805c1320
Opcode Fuzzy Hash: b79fce6431be69057aa7f42918c2d2135c873c19bbed57f4db6d95c06a05dec3
Instruction Fuzzy Hash: 7DA13672E007869FEB21CE18C8917AEBBE5EF55310F18816DE59D9B282C73C9D41C758

Function 00083608 Relevance: 6.2, APIs: 4, Instructions: 152COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00083737

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free
String ID:
API String ID: 269201875-0
Opcode ID: a5009d851797c50a99453a942aa1015634d9468b8e14b4020c89b9a57f6ac9bf
Instruction ID: fc194990ad3449c60fd50cb78353c3f2ce7b5665cea6ec4fd18faeb340cfb046
Opcode Fuzzy Hash: a5009d851797c50a99453a942aa1015634d9468b8e14b4020c89b9a57f6ac9bf
Instruction Fuzzy Hash: F64138B1A041007ADB317ABCDC86BEE3BA5FF85B70F148215F498D6293EA788A504765

Function 00075B6D Relevance: 6.1, APIs: 4, Instructions: 133COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7b3d58c46ee910e109b41f7ccea4f917a40f16acf599133b2ca912017eac1d5f
Instruction ID: 2a7e81888093f6a3537ae60e8596e190d39e78a13cfc7fc53e58f939e222e3af
Opcode Fuzzy Hash: 7b3d58c46ee910e109b41f7ccea4f917a40f16acf599133b2ca912017eac1d5f
Instruction Fuzzy Hash: E241FE71E00708AFD725AF78CC42BEA7BE5EB88711F10C52AF155DB2C1D7B5A9018794

Function 0007141E Relevance: 6.1, APIs: 4, Instructions: 63COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad0e3618d7de9eb92e278036699dae1e1c3ce2dfff5cdb97b36eb5dafd3b770a
Instruction ID: ab7e4b12390217368fe7841a411df48da246772f3ede61e6b474057de0a154fd
Opcode Fuzzy Hash: ad0e3618d7de9eb92e278036699dae1e1c3ce2dfff5cdb97b36eb5dafd3b770a
Instruction Fuzzy Hash: 9B01A2B2A093167EFB601A7C6CC1FA7625DEB517B8B318725F529612D1DB698C004178

Function 000523B6 Relevance: 6.1, APIs: 4, Instructions: 56COMMON

Download Yara Rule

APIs

VerSetConditionMask.KERNEL32(00000000,00000000,00000002,00000003,00000001,00000003,00000020,00000003), ref: 0005241E
VerSetConditionMask.KERNEL32(00000000), ref: 00052426
VerSetConditionMask.KERNEL32(00000000), ref: 0005242E
VerifyVersionInfoW.KERNEL32(0000011C,00000023,00000000), ref: 00052455

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ConditionMask$InfoVerifyVersion
String ID:
API String ID: 2793162063-0
Opcode ID: 9d0b93761a18af136191b1f4a66d7d36a20daf366b1ddb651ee02797482aaa24
Instruction ID: 3b740717b1f6fda0a7738760321057d9036e74b5e347163c1a5cb75d82408e10
Opcode Fuzzy Hash: 9d0b93761a18af136191b1f4a66d7d36a20daf366b1ddb651ee02797482aaa24
Instruction Fuzzy Hash: 5A112170D11328ABEB20DF64DC0ABDF7ABCFF49B00F004099B549E6182D7754B508B95

Function 00067829 Relevance: 6.1, APIs: 4, Instructions: 53COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBVCRUNTIME ref: 00067843

Part of subcall function 00067790: BuildCatchObjectHelperInternal.LIBVCRUNTIME ref: 000677BF
Part of subcall function 00067790: ___AdjustPointer.LIBCMT ref: 000677DA

_UnwindNestedFrames.LIBCMT ref: 00067858
__FrameHandler3::FrameUnwindToState.LIBVCRUNTIME ref: 00067869
CallCatchBlock.LIBVCRUNTIME ref: 00067891

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: Catch$BuildFrameObjectUnwind$AdjustBlockCallFramesHandler3::HelperInternalNestedPointerState
String ID:
API String ID: 737400349-0
Opcode ID: 129835af75f3a1856c9a48a297342f507ea6b2febbf417c2ab55121898baf65b
Instruction ID: c12d9db7e79b0ffa0cbbfb4fe32679eabf503ed4f7f8c19575143bae12185823
Opcode Fuzzy Hash: 129835af75f3a1856c9a48a297342f507ea6b2febbf417c2ab55121898baf65b
Instruction Fuzzy Hash: 5C011732100109BBDF125E95CC45EEB3BAAFF89758F044118FA08A6122DA32E861DBA0

Function 00075148 Relevance: 6.1, APIs: 4, Instructions: 52libraryCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(00000000,00000000,00000800,?,00000000,00000000,?,000750EF,?,00000000,00000000,00000000,?,0007541B,00000006,FlsSetValue), ref: 0007517A
GetLastError.KERNEL32(?,000750EF,?,00000000,00000000,00000000,?,0007541B,00000006,FlsSetValue,0008C8B0,FlsSetValue,00000000,00000364,?,00073DF7), ref: 00075186
LoadLibraryExW.KERNEL32(00000000,00000000,00000000,?,000750EF,?,00000000,00000000,00000000,?,0007541B,00000006,FlsSetValue,0008C8B0,FlsSetValue,00000000), ref: 00075194

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: LibraryLoad$ErrorLast
String ID:
API String ID: 3177248105-0
Opcode ID: 7cafbbbd6ad11c594766fce6fb2b6933000c171780877dcca360c99b50d3112b
Instruction ID: 31154c0ca798e982c57b32d939804b136afd59d4581efc17bf7f1838a798f0ae
Opcode Fuzzy Hash: 7cafbbbd6ad11c594766fce6fb2b6933000c171780877dcca360c99b50d3112b
Instruction Fuzzy Hash: 4D01FC32A02A229BE7314B68DC44B9B37D9BF057A37918224F94DD7140D769DC00CBE8

Function 0005E31C Relevance: 6.0, APIs: 4, Instructions: 43COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 0005E323
std::_Locinfo::_Locinfo.LIBCPMT ref: 0005E35D

Part of subcall function 00059066: __EH_prolog3.LIBCMT ref: 0005906D
Part of subcall function 00059066: std::_Lockit::_Lockit.LIBCPMT ref: 0005907A
Part of subcall function 00059066: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000590B7

numpunct.LIBCPMT ref: 0005E37D

Part of subcall function 0005E3F0: __EH_prolog3_catch.LIBCMT ref: 0005E3F7
Part of subcall function 0005E3F0: __Getcvt.LIBCPMT ref: 0005E40C
Part of subcall function 0005E3F0: __Getcvt.LIBCPMT ref: 0005E439

std::_Locinfo::~_Locinfo.LIBCPMT ref: 0005E387

Part of subcall function 000590F9: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00059120
Part of subcall function 000590F9: std::_Lockit::~_Lockit.LIBCPMT ref: 00059191

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::_$Locinfo::_$GetcvtH_prolog3LocinfoLockit$H_prolog3_catchLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_numpunct
String ID:
API String ID: 4110376795-0
Opcode ID: 7ab03c90aa16e3c24cbfe7607b994ed010bf890eacb2d719ef90d941e929b258
Instruction ID: 36e251fc84c03c077b5053734c52910cdf2a247af6d55f150e09b956d15c052e
Opcode Fuzzy Hash: 7ab03c90aa16e3c24cbfe7607b994ed010bf890eacb2d719ef90d941e929b258
Instruction Fuzzy Hash: 9701A2B19002149BDF28AF94D8467AF7BE5EF44711F10441EF9459B283CF704B058B51

Function 00063EF0 Relevance: 6.0, APIs: 4, Instructions: 41COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(0009DCF4,?,?,00059E31,0009E65C,?,?,?,?,0005C7FA,?,00000000), ref: 00063EFA
LeaveCriticalSection.KERNEL32(0009DCF4,?,?,00059E31,0009E65C,?,?,?,?,0005C7FA,?,00000000), ref: 00063F2D
SetEvent.KERNEL32(00000000,00059E31,0009E65C,?,?,?,?,0005C7FA,?,00000000), ref: 00063FBB
ResetEvent.KERNEL32(?,?,?,?,0005C7FA,?,00000000), ref: 00063FC7

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CriticalEventSection$EnterLeaveReset
String ID:
API String ID: 3553466030-0
Opcode ID: d98ee19ee27482303f77b532849cdb4d7e23e08d7150d0d1bbbbb553d6f9a134
Instruction ID: b0318ecdf7561e2cd9829946c85275c6937b17983da27b76d41e0366aa9ea284
Opcode Fuzzy Hash: d98ee19ee27482303f77b532849cdb4d7e23e08d7150d0d1bbbbb553d6f9a134
Instruction Fuzzy Hash: 8D014B71A45224DBEF08AF58FD48AA977B5FB89701B02006BF90297321CB796810CBD8

Function 00058CCA Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

__EH_prolog3.LIBCMT ref: 00058CD1
std::_Locinfo::_Locinfo.LIBCPMT ref: 00058CFF

Part of subcall function 00059066: __EH_prolog3.LIBCMT ref: 0005906D
Part of subcall function 00059066: std::_Lockit::_Lockit.LIBCPMT ref: 0005907A
Part of subcall function 00059066: std::_Locinfo::_Locinfo_ctor.LIBCPMT ref: 000590B7

ctype.LIBCPMT ref: 00058D11

Part of subcall function 00058C79: __Getctype.LIBCPMT ref: 00058C88
Part of subcall function 00058C79: __Getcvt.LIBCPMT ref: 00058C9A

std::_Locinfo::~_Locinfo.LIBCPMT ref: 00058D1B

Part of subcall function 000590F9: std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 00059120
Part of subcall function 000590F9: std::_Lockit::~_Lockit.LIBCPMT ref: 00059191

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: std::_$Locinfo::_$H_prolog3LocinfoLockit$GetctypeGetcvtLocinfo::~_Locinfo_ctorLocinfo_dtorLockit::_Lockit::~_ctype
String ID:
API String ID: 1262428101-0
Opcode ID: a8a8b191ba754507aa395dfe9c5f90c339aee039e87a0f69aa6fb3135c3e0fbe
Instruction ID: de9a9f47ec1f64a8044e604fcab8848131d42b21aa08a0ba9ea8af3916e78ed4
Opcode Fuzzy Hash: a8a8b191ba754507aa395dfe9c5f90c339aee039e87a0f69aa6fb3135c3e0fbe
Instruction Fuzzy Hash: 69F05E719006059BDB24AF54C4067EE77F5AF50712F608409FC1A6B2C3DF749A08CBA1

Function 0006F22D Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 189COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 0006F2BD

Strings

pow, xrefs: 0006F295, 0006F2B2

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ErrorHandling__start
String ID: pow
API String ID: 3213639722-2276729525
Opcode ID: aaeb25ffe6b92e118ef66a269ba85157c90d5dc74bc1cbb29c63dcf9846ae570
Instruction ID: 5d6e411f1bac070185a106ac323c3780f025dc46ff20e527de3474dda466bfab
Opcode Fuzzy Hash: aaeb25ffe6b92e118ef66a269ba85157c90d5dc74bc1cbb29c63dcf9846ae570
Instruction Fuzzy Hash: 9C514C71E04207D6DB517B18E9523BE3BE5FB40740F30CD79E4D9822A9EB3C8C949A4A

Function 0005C5DB Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 101COMMON

Download Yara Rule

APIs

__EH_prolog3_GS.LIBCMT ref: 0005C5E5

Part of subcall function 0005C95A: __EH_prolog3.LIBCMT ref: 0005C961

Part of subcall function 0005B8B0: __EH_prolog3_catch.LIBCMT ref: 0005B8B7

Part of subcall function 0005CF30: __EH_prolog3_catch.LIBCMT ref: 0005CF37
Part of subcall function 0005CF30: std::locale::locale.LIBCPMT ref: 0005CF67
Part of subcall function 0005CF30: std::locale::~locale.LIBCPMT ref: 0005CF82

std::ios_base::_Ios_base_dtor.LIBCPMT ref: 0005C72B

Strings

hi, xrefs: 0005C639

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: H_prolog3_catch$H_prolog3H_prolog3_Ios_base_dtorstd::ios_base::_std::locale::localestd::locale::~locale
String ID: hi
API String ID: 2745547310-1952852928
Opcode ID: ddd693fbd6894f9af368b345a2f816e2614e5fa9791cdada2ee33a4e860b717a
Instruction ID: 4d4a07b33e9f60f5dd0ccffe964f3684d01465c474ebc42ea8fc5f1a840b151b
Opcode Fuzzy Hash: ddd693fbd6894f9af368b345a2f816e2614e5fa9791cdada2ee33a4e860b717a
Instruction Fuzzy Hash: E8412F71A102589FEF29EBA8C851FDE77B6BF44301F1085ADE80AA7242DB705E48CF14

Function 0007EA21 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 88COMMONLIBRARYCODE

Download Yara Rule

APIs

GetACP.KERNEL32(?,20001004,?,00000002,00000000,00000050,00000050,?,0007EC7C,?,00000050,?,?,?,?,?), ref: 0007EAFC

Strings

ACP, xrefs: 0007EA3F
OCP, xrefs: 0007EA75

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID:
String ID: ACP$OCP
API String ID: 0-711371036
Opcode ID: a802a22b148ed64c64a7bf5af6dd0575c62b91b7f22b59ee30f9f53464c941b7
Instruction ID: 77cc17833dfdb962f455cd2a93c1e053ea8459788790784240c96b562dcf3ddd
Opcode Fuzzy Hash: a802a22b148ed64c64a7bf5af6dd0575c62b91b7f22b59ee30f9f53464c941b7
Instruction Fuzzy Hash: 0421B262E02280B6EB70DF24C901B9B63DABB58B14F56C4B4E90ED7101E73AFD00C359

Function 000518C4 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 41COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104,80000001,SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce,00020006), ref: 00051917

Strings

SquirrelInstall, xrefs: 00051925
SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce, xrefs: 000518E5

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: FileModuleName
String ID: SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce$SquirrelInstall
API String ID: 514040917-3364363029
Opcode ID: 3653f180298af15de64b5900deee547a96a40e62e4fab4b7f1a6a4a5fc19970a
Instruction ID: 368ed040d78b28027bca247257fa156bcd9d36a0cbbfde33afa88b36aa4c4258
Opcode Fuzzy Hash: 3653f180298af15de64b5900deee547a96a40e62e4fab4b7f1a6a4a5fc19970a
Instruction Fuzzy Hash: 2001867094031CABDB10DFA0DCD5FEEB3B8AB25704F4005E9A916A6192EA749F8DCF50

Function 00071177 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 000711C5

Strings

|, xrefs: 000711AB

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: _free
String ID: |
API String ID: 269201875-2460580545
Opcode ID: 2000be9a1b55aa6d0ab4634f4e461887ee39468e0f78b4593bc5098ee78ae99a
Instruction ID: 780b3096d4cf0eb50b62b29489915862d175cd1f35d3751fa9ab312ae2a5ca89
Opcode Fuzzy Hash: 2000be9a1b55aa6d0ab4634f4e461887ee39468e0f78b4593bc5098ee78ae99a
Instruction Fuzzy Hash: 5EE0A032E0545160F271323DBC01BEB1A856B82770F55C22AF52C8A1D3DE3C4D4191AE

Function 000612A4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 25COMMON

Download Yara Rule

APIs

std::invalid_argument::invalid_argument.LIBCONCRT ref: 000612B0
__CxxThrowException@8.LIBVCRUNTIME ref: 000612BE

Part of subcall function 000655AE: RaiseException.KERNEL32(?,?,?,0006475F,?,00000000,00000000,?,?,?,?,?,0006475F,00000001,0009A2CC), ref: 0006560E

Strings

bad function call, xrefs: 000612D0

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ExceptionException@8RaiseThrowstd::invalid_argument::invalid_argument
String ID: bad function call
API String ID: 4038826145-3612616537
Opcode ID: 7667692d0649d6d253676a014fa396a337b0b439c84d20a2a1198e07d0fbcddc
Instruction ID: f4dfbfb0410b24ebee52a91c5aafa3c276aaf977d0d66b0118e18986e295e6d7
Opcode Fuzzy Hash: 7667692d0649d6d253676a014fa396a337b0b439c84d20a2a1198e07d0fbcddc
Instruction Fuzzy Hash: C1C01238D0010C77CF04B6A4D8278CC773AAB04700F8088607A10D2142D67596199AC2

Function 000639E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

Part of subcall function 00051CED: InitializeCriticalSectionEx.KERNEL32(00000008,00000000,00000000,00000000,00051CA4,00000014,000515FA), ref: 00051CF3
Part of subcall function 00051CED: GetLastError.KERNEL32 ref: 00051CFD

IsDebuggerPresent.KERNEL32(?,?,?,0005120A), ref: 00063A1A
OutputDebugStringW.KERNEL32(ERROR : Unable to initialize critical section in CAtlBaseModule,?,?,?,0005120A), ref: 00063A29

Strings

ERROR : Unable to initialize critical section in CAtlBaseModule, xrefs: 00063A24

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: CriticalDebugDebuggerErrorInitializeLastOutputPresentSectionString
String ID: ERROR : Unable to initialize critical section in CAtlBaseModule
API String ID: 3511171328-631824599
Opcode ID: a89e4f7016ca593c742c0fd4902481f62effaf64cc0e755273ee82438139a18e
Instruction ID: 081b563bac07bda1b2353cf750704f77af0696ad7f691e57743f7daa6f80a0eb
Opcode Fuzzy Hash: a89e4f7016ca593c742c0fd4902481f62effaf64cc0e755273ee82438139a18e
Instruction Fuzzy Hash: EBE06D702003508BE760AFA4D408393BAE4BB04714F08891DE8C6C6352E7BAE548CB92

Function 00079BB7 Relevance: 5.1, APIs: 4, Instructions: 139COMMONLIBRARYCODE

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(?,00000009,00000000,00000000,00000000,00000000,00000032,00000032,00000000,00000000,00000000,00000032,00000000,00000000,00000000,00059DE7), ref: 00079C4D
GetLastError.KERNEL32 ref: 00079C5B
MultiByteToWideChar.KERNEL32(?,00000001,?,?,00000000,00000000), ref: 00079CB6

Memory Dump Source

Source File: 00000005.00000002.2133969395.0000000000051000.00000020.00000001.01000000.0000000A.sdmp, Offset: 00050000, based on PE: true

Associated: 00000005.00000002.2133892902.0000000000050000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134003959.0000000000086000.00000002.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134043115.000000000009C000.00000004.00000001.01000000.0000000A.sdmpDownload File
Associated: 00000005.00000002.2134068817.000000000009F000.00000002.00000001.01000000.0000000A.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_50000_MSTeamsSetup_c_l_.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID:
API String ID: 1717984340-0
Opcode ID: 3d0762c18c3b419dedaabcf86d2175d1d5dfc9edd764ab4c45b4afee7528bbf7
Instruction ID: 1d47a28b3734aae12bafda43efcb94fbd7333e534013891f7f7d6a4065aec089
Opcode Fuzzy Hash: 3d0762c18c3b419dedaabcf86d2175d1d5dfc9edd764ab4c45b4afee7528bbf7
Instruction Fuzzy Hash: BC41B731E0024AAFDF328F64D844ABA7BE5EF01310F25C169E95D9B2A1DB359D01C764

Analysis Process: client32.exePID: 1272, Parent PID: 1068COMMON

Non-executed Functions

Function 1109D020 Relevance: 98.5, APIs: 41, Strings: 15, Instructions: 501filethreadmemoryCOMMON

Download Yara Rule

APIs

Part of subcall function 1109C2D0: GetCurrentProcess.KERNEL32(000F01FF,?,1102FC83,00000000,00000000,?,D68DEC44,?,00000000), ref: 1109C2FD
Part of subcall function 1109C2D0: OpenProcessToken.ADVAPI32(00000000,?,00000000), ref: 1109C304
Part of subcall function 1109C2D0: LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109C315
Part of subcall function 1109C2D0: AdjustTokenPrivileges.ADVAPI32(00000000,00000000,?,00000010), ref: 1109C339

LocalAlloc.KERNEL32(00000040,00000014,SeSecurityPrivilege,?,?,D68DEC44,?,00000000), ref: 1109D0B5
InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00000000), ref: 1109D0CE
SetSecurityDescriptorDacl.ADVAPI32(00000000,00000001,00000000,00000000,?,00000000), ref: 1109D0D9
GetVersionExA.KERNEL32(?,?,00000000), ref: 1109D0F0
GetSecurityDescriptorSacl.ADVAPI32(?,?,?,?,S:(ML;;NW;;;LW),00000001,?,00000000,?,00000000), ref: 1109D15E
SetSecurityDescriptorSacl.ADVAPI32(00000000,00000001,?,00000000,?,00000000), ref: 1109D173
FreeLibrary.KERNEL32(?,S:(ML;;NW;;;LW),00000001,?,00000000,?,00000000), ref: 1109D184
CreateFileMappingA.KERNEL32(000000FF,1102FC83,00000004,00000000,?,?), ref: 1109D1C0
GetLastError.KERNEL32(?,00000000), ref: 1109D1CD
LocalFree.KERNEL32(?,00000000), ref: 1109D1F6
LocalFree.KERNEL32(?,00000000), ref: 1109D203
GetLastError.KERNEL32(?,00000000), ref: 1109D220
MapViewOfFile.KERNEL32(?,000F001F,00000000,00000000,00000000,?,00000000), ref: 1109D23E
LocalFree.KERNEL32(?), ref: 1109D269
LocalFree.KERNEL32(?), ref: 1109D276

Part of subcall function 1109C230: LoadLibraryA.KERNEL32(Advapi32.dll,00000000,1109D10E,?,00000000), ref: 1109C238

Part of subcall function 1109C270: GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109C284

GetModuleFileNameA.KERNEL32(00000000,?,00000104,?,00000000), ref: 1109D2A2
LocalFree.KERNEL32(?), ref: 1109D36B
LocalFree.KERNEL32(?), ref: 1109D378
GetTickCount.KERNEL32 ref: 1109D398
GetCurrentProcessId.KERNEL32 ref: 1109D444
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1109D45F
CreateEventA.KERNEL32(?,00000000,00000000,?,?,?,?,?,?), ref: 1109D4AB
GetLastError.KERNEL32 ref: 1109D4B4
GetLastError.KERNEL32(00000000), ref: 1109D4BB
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109D4F0
GetLastError.KERNEL32 ref: 1109D4F9
GetLastError.KERNEL32(00000000), ref: 1109D500
CreateEventA.KERNEL32(?,00000001,00000000,?), ref: 1109D536
GetLastError.KERNEL32 ref: 1109D53F
GetLastError.KERNEL32(00000000), ref: 1109D546
CreateEventA.KERNEL32(?,00000000,00000000,?), ref: 1109D57B
GetLastError.KERNEL32 ref: 1109D58A
GetLastError.KERNEL32(00000000), ref: 1109D58D
LocalFree.KERNEL32(?), ref: 1109D5B5
LocalFree.KERNEL32(?), ref: 1109D5C2
GetCurrentThreadId.KERNEL32 ref: 1109D5F3
CreateThread.KERNEL32(00000000,00002000,1109CBB0,00000000,00000000,00000030), ref: 1109D60D
ResetEvent.KERNEL32(?), ref: 1109D63C
ResetEvent.KERNEL32(?), ref: 1109D642
ResetEvent.KERNEL32(?), ref: 1109D648
SetEvent.KERNEL32(?), ref: 1109D64E

Strings

Error creating filemap (%d), xrefs: 1109D1D4
Error cant create events, xrefs: 1109D677
Error filemap exists, xrefs: 1109D34D
Error cant map view, xrefs: 1109D24B
SeSecurityPrivilege, xrefs: 1109D08A
cant create events, xrefs: 1109D684
Cant create event %s, e=%d (x%x), xrefs: 1109D4C9, 1109D50E, 1109D554, 1109D597
map exists, xrefs: 1109D37A
Info - reusing existing filemap, xrefs: 1109D309
S:(ML;;NW;;;LW), xrefs: 1109D118
warning map exists, xrefs: 1109D320
cant create filemap, xrefs: 1109D205
cant map, xrefs: 1109D278
cant create thread, xrefs: 1109D61A
IPC(%s) created, xrefs: 1109D658

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast$FreeLocal$Event$Create$DescriptorFileSecurity$CurrentProcessReset$LibraryModuleNameSaclThreadToken$AddressAdjustAllocCountDaclInitializeLoadLookupMappingOpenPrivilegePrivilegesProcTickValueVersionView
String ID: Cant create event %s, e=%d (x%x)$Error cant create events$Error cant map view$Error creating filemap (%d)$Error filemap exists$IPC(%s) created$Info - reusing existing filemap$S:(ML;;NW;;;LW)$SeSecurityPrivilege$cant create events$cant create filemap$cant create thread$cant map$map exists$warning map exists
API String ID: 4267466239-2792520954
Opcode ID: 1126004c19709eef36c463d461edf4d5d9ea8a6efb619ff83f89988371318893
Instruction ID: a11a5b42106259b8934735cdc9776a3acf290214adfdae345ddc409aedb5d6fc
Opcode Fuzzy Hash: 1126004c19709eef36c463d461edf4d5d9ea8a6efb619ff83f89988371318893
Instruction Fuzzy Hash: 37128EB5E402599FDB20DF65CCD4AAEB7FAFB88308F0085A9E50D93240D671A984CF61

Function 11007730 Relevance: 82.8, APIs: 33, Strings: 14, Instructions: 548windowCOMMON

Download Yara Rule

APIs

Part of subcall function 110877E0: IsWindow.USER32(11005592), ref: 110877FC
Part of subcall function 110877E0: IsWindow.USER32(?), ref: 11087816

LoadCursorA.USER32(00000000,00007F02), ref: 1100777A
SetCursor.USER32(00000000), ref: 11007781
GetDC.USER32(?), ref: 110077AD
CreateCompatibleDC.GDI32(00000000), ref: 110077BA
CreateCompatibleBitmap.GDI32(?,?,?), ref: 110078C4
SelectObject.GDI32(?,00000000), ref: 110078D2
CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 110078E6
CreateCompatibleDC.GDI32(00000000), ref: 110078F3
CreateCompatibleBitmap.GDI32(?,?,?), ref: 11007905
SelectObject.GDI32(?,00000000), ref: 11007916

Part of subcall function 110943C0: GetSystemMetrics.USER32(0000004C), ref: 110943CE
Part of subcall function 110943C0: GetSystemMetrics.USER32(0000004D), ref: 110943D7
Part of subcall function 110943C0: GetSystemMetrics.USER32(0000004E), ref: 110943DE
Part of subcall function 110943C0: GetSystemMetrics.USER32(00000000), ref: 110943E7
Part of subcall function 110943C0: GetSystemMetrics.USER32(0000004F), ref: 110943ED
Part of subcall function 110943C0: GetSystemMetrics.USER32(00000001), ref: 110943F5

SelectClipRgn.GDI32(?,00000000), ref: 11007931

Part of subcall function 11002240: DeleteObject.GDI32(?), ref: 11002251
Part of subcall function 11002240: CreatePen.GDI32(?,?,?), ref: 11002278

Part of subcall function 11005AB0: CreateSolidBrush.GDI32(?), ref: 11005AD7

BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 1100795B
SelectClipRgn.GDI32(?,00000000), ref: 11007970
DeleteObject.GDI32(00000000), ref: 1100797D
DeleteDC.GDI32(?), ref: 1100798A
BitBlt.GDI32(?,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 110079A7
ReleaseDC.USER32(?,?), ref: 110079D6
CreatePen.GDI32(00000002,00000001,00000000), ref: 110079E1
CreateSolidBrush.GDI32(?), ref: 11007AD2
GetSysColor.USER32(00000004), ref: 11007AE0
LoadBitmapA.USER32(00000000,00002EEF), ref: 11007AF7

Part of subcall function 1113E930: GetObjectA.GDI32(11003CE6,00000018,?), ref: 1113E943
Part of subcall function 1113E930: CreateCompatibleDC.GDI32(00000000), ref: 1113E951
Part of subcall function 1113E930: CreateCompatibleDC.GDI32(00000000), ref: 1113E956
Part of subcall function 1113E930: SelectObject.GDI32(00000000,00000000), ref: 1113E96E
Part of subcall function 1113E930: CreateBitmap.GDI32(?,?,00000001,00000001,00000000), ref: 1113E981
Part of subcall function 1113E930: SelectObject.GDI32(00000000,00000000), ref: 1113E98C
Part of subcall function 1113E930: SetBkColor.GDI32(00000000,?), ref: 1113E996
Part of subcall function 1113E930: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00CC0020), ref: 1113E9B3
Part of subcall function 1113E930: SetBkColor.GDI32(00000000,00000000), ref: 1113E9BC
Part of subcall function 1113E930: SetTextColor.GDI32(00000000,00FFFFFF), ref: 1113E9C8
Part of subcall function 1113E930: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,008800C6), ref: 1113E9E5
Part of subcall function 1113E930: SetBkColor.GDI32(00000000,?), ref: 1113E9F0
Part of subcall function 1113E930: SetTextColor.GDI32(00000000,00000000), ref: 1113E9F9
Part of subcall function 1113E930: BitBlt.GDI32(00000000,00000000,00000000,?,?,00000000,00000000,00000000,00EE0086), ref: 1113EA16
Part of subcall function 1113E930: SelectObject.GDI32(00000000,00000000), ref: 1113EA21

_swscanf.LIBCMT ref: 11007BC4

Part of subcall function 11080A00: _strrchr.LIBCMT ref: 11080A0E

CreateFontIndirectA.GDI32(?), ref: 11007BF5
GetStockObject.GDI32(00000011), ref: 11007C2F
GetObjectA.GDI32(00000000), ref: 11007C36
CreateFontIndirectA.GDI32(?), ref: 11007C43
GetWindowRect.USER32(?,?), ref: 11007D86
SetWindowTextA.USER32(?,00000000), ref: 11007DC3
GetSystemMetrics.USER32(00000001), ref: 11007DE3
GetSystemMetrics.USER32(00000000), ref: 11007E00
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000001), ref: 11007E50
UpdateWindow.USER32(?), ref: 11007E82
SetCursor.USER32(?), ref: 11007E8F

Strings

m_hWnd, xrefs: 1100779C, 110079BE, 11007D6E, 11007DB1, 11007E2F, 11007E71
Annotate, xrefs: 110079FF, 11007A17, 11007A42, 11007A6B, 11007A8A, 11007B36
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11007797, 110079B9, 11007D69, 11007DAC, 11007E2A, 11007E6C
ShowAppIds, xrefs: 1100787A
Monitor, xrefs: 110077E7
FillColour, xrefs: 11007A66
FillStyle, xrefs: 11007A7C
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11007BBE
DISPLAY, xrefs: 110078DE
PenColour, xrefs: 11007A12
PenWidth, xrefs: 11007A2E
Font, xrefs: 11007B31
Show, xrefs: 110077EC, 1100787F
Tool, xrefs: 110079FA

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$Object$MetricsSystem$Select$ColorCompatibleWindow$Bitmap$CursorDeleteText$BrushClipFontIndirectLoadSolid$RectReleaseStockUpdate_strrchr_swscanf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$DISPLAY$FillColour$FillStyle$Font$Monitor$PenColour$PenWidth$Show$ShowAppIds$Tool$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3053714225-2303488826
Opcode ID: 216b5839d51228f7c24cb7af1d939b16d992ae86a01a28ef4e598b36cda6af65
Instruction ID: 54aafe2c3740aa077af896bede48458252c69403344822a02566e1774dcb7910
Opcode Fuzzy Hash: 216b5839d51228f7c24cb7af1d939b16d992ae86a01a28ef4e598b36cda6af65
Instruction Fuzzy Hash: CD2293B5A0071AAFE750DF64CC84FDAF7B9BB48708F1085ADE65A97280DB70A940CF51

Function 1110C060 Relevance: 30.0, APIs: 12, Strings: 5, Instructions: 241filetimeCOMMON

Download Yara Rule

APIs

Part of subcall function 1110BB40: EnterCriticalSection.KERNEL32(?,D68DEC44,?,?,?,?,?,?,?,?,?,111863B8,000000FF,?,1110C097,00000001), ref: 1110BB77
Part of subcall function 1110BB40: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 1110BC4A

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

GetLocalTime.KERNEL32(?,?,PrefixName,00000000,00000000), ref: 1110C0DD
wsprintfA.USER32 ref: 1110C126
FindFirstFileA.KERNEL32(?,?,?,PrefixName,00000000,00000000), ref: 1110C157
FindNextFileA.KERNEL32(00000000,?), ref: 1110C181
FindClose.KERNEL32(00000000), ref: 1110C18C
wsprintfA.USER32 ref: 1110C1A0
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 1110C1C8
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,08000000,00000000), ref: 1110C1E7
timeBeginPeriod.WINMM(00000001), ref: 1110C211
GetLocalTime.KERNEL32(?), ref: 1110C236
timeGetTime.WINMM ref: 1110C23C
WriteFile.KERNEL32(00000000,?,00000030,?,00000000), ref: 1110C26C

Strings

%s_%02d%02d%02d_%02d%02d_%02d.rpf, xrefs: 1110C120
Start Record %s, xrefs: 1110C202
PrefixName, xrefs: 1110C0C7
*.rpf, xrefs: 1110C137
%08d.rpf, xrefs: 1110C19A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$FindTime$Localtimewsprintf$BeginCloseCreateCriticalEnterEnvironmentExpandFirstNextPeriodPointerSectionStringsWrite__wcstoi64
String ID: %08d.rpf$%s_%02d%02d%02d_%02d%02d_%02d.rpf$*.rpf$PrefixName$Start Record %s
API String ID: 3072557685-3549260256
Opcode ID: 0003f43de39b684e5cfd07eb3c616b5f87131ba09684af2c9f8004fad9768fd8
Instruction ID: 530243315622f6a9b3cdc143f10c56512a331feeb675d225be18755b847c4a54
Opcode Fuzzy Hash: 0003f43de39b684e5cfd07eb3c616b5f87131ba09684af2c9f8004fad9768fd8
Instruction Fuzzy Hash: A891E371A00705ABD720DFB4CC89FEBF7B8EB89704F008569F66A97280EA746540CB51

Function 1102D516 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 203fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1110D1E0: DeleteCriticalSection.KERNEL32(?,D68DEC44,?,?,?,?,00000000,1117E388,000000FF,?,1100CAFD), ref: 1110D22A
Part of subcall function 1110D1E0: EnterCriticalSection.KERNEL32 ref: 1110D275
Part of subcall function 1110D1E0: SetEvent.KERNEL32(?), ref: 1110D29E
Part of subcall function 1110D1E0: CloseHandle.KERNEL32(?), ref: 1110D2D2
Part of subcall function 1110D1E0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 1110D2E0
Part of subcall function 1110D1E0: CloseHandle.KERNEL32(?), ref: 1110D2ED

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1102D5B4
GetFileAttributesA.KERNEL32(?), ref: 1102D5C1
FindFirstFileA.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 1102D67B
FindNextFileA.KERNEL32(00000000,00000010), ref: 1102D6A2
FindClose.KERNEL32(00000000), ref: 1102D6A9

Strings

*.*, xrefs: 1102D653
Stop tracing, almost terminated, xrefs: 1102D768
Error %s unloading audiocap dll, xrefs: 1102D576
CLIENT32.CPP, xrefs: 1102D63F
Finished terminate, xrefs: 1102D7C6
pSlash, xrefs: 1102D644

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CloseFind$CriticalHandleSection$AttributesDeleteEnterEventFirstModuleNameNextObjectSingleWait
String ID: *.*$CLIENT32.CPP$Error %s unloading audiocap dll$Finished terminate$Stop tracing, almost terminated$pSlash
API String ID: 1081535095-3280288299
Opcode ID: 072b9882d00594b1e24047cc14f0d73718eb5e34f0e9f039455f752a814f4eb5
Instruction ID: e4e41f0b8b9fc13eefdae578a47d95c0906ea7d825d93c4d8f1a563cc3a5f3e8
Opcode Fuzzy Hash: 072b9882d00594b1e24047cc14f0d73718eb5e34f0e9f039455f752a814f4eb5
Instruction Fuzzy Hash: C3714475A006669FEB01DFE0CCC4BBDB3A1BB4470CF5041B9E62997184E7B16D84CBA2

Function 1102D212 Relevance: 28.2, APIs: 10, Strings: 6, Instructions: 202sleepfileshutdownCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 1102D5B4
GetFileAttributesA.KERNEL32(?), ref: 1102D5C1
FindFirstFileA.KERNEL32(?,?,?,?,?,00000000,00000000), ref: 1102D67B
FindNextFileA.KERNEL32(00000000,00000010), ref: 1102D6A2
FindClose.KERNEL32(00000000), ref: 1102D6A9

Part of subcall function 11132A50: LoadIconA.USER32(00000000,00000455), ref: 11132BA3
Part of subcall function 11132A50: Shell_NotifyIconA.SHELL32(00000000,000001E8,?,?,?,?,?,?,?,00000001,00000000,D68DEC44), ref: 11132BD6

ExitWindowsEx.USER32(00000002,00000000), ref: 1102D797
Sleep.KERNEL32(00002710), ref: 1102D79E
ExitWindowsEx.USER32(00000006,00000000), ref: 1102D7B4
Sleep.KERNEL32(000007D0), ref: 1102D7C0
ExitProcess.KERNEL32 ref: 1102D7D4

Strings

*.*, xrefs: 1102D653
Stop tracing, almost terminated, xrefs: 1102D768
Error %s unloading audiocap dll, xrefs: 1102D576
CLIENT32.CPP, xrefs: 1102D63F
Finished terminate, xrefs: 1102D7C6
pSlash, xrefs: 1102D644

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$ExitFind$IconSleepWindows$AttributesCloseFirstLoadModuleNameNextNotifyProcessShell_
String ID: *.*$CLIENT32.CPP$Error %s unloading audiocap dll$Finished terminate$Stop tracing, almost terminated$pSlash
API String ID: 2556316633-3280288299
Opcode ID: 95eafb584d8cfb23c6f7bb4936ebeb8b0220b4503d9f879406b1d2dd4d4b2e9c
Instruction ID: 2717cdc3228b0bd27e491d64b8d5f50cbb297b4273d5e70b515f6c15fd58a102
Opcode Fuzzy Hash: 95eafb584d8cfb23c6f7bb4936ebeb8b0220b4503d9f879406b1d2dd4d4b2e9c
Instruction Fuzzy Hash: 83715275E006669FEB11DFE0CCC4BADB3A0BB4470CF5041B9D62997284EBB16D84CB92

Function 110253E0 Relevance: 23.1, APIs: 9, Strings: 4, Instructions: 384windowtimeCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 1102554E
GetMenu.USER32(?), ref: 11025577
DrawMenuBar.USER32(?), ref: 1102558E
GetMenu.USER32(?), ref: 110255E3
DeleteMenu.USER32(00000000,00000001,00000400), ref: 110255F1
UpdateWindow.USER32(?), ref: 11025637
IsIconic.USER32(?), ref: 1102564A
SetTimer.USER32(00000000,00000000,000003E8,00000000), ref: 1102566A
KillTimer.USER32(00000000,00000000,00000080,00000002), ref: 110256D0

Strings

m_hWnd, xrefs: 11025626
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11025621
Chat, xrefs: 11025408
..\ctl32\chatw.cpp, xrefs: 1102543A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$TimerWindow$DeleteDrawIconicKillUpdate
String ID: ..\ctl32\chatw.cpp$Chat$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 129586695-363603473
Opcode ID: 6d97942b4b7603c8db43bb55491f262dc327f23349ad49d2ddbad8683677c109
Instruction ID: c241bcf11bc04a080c6966cd6554540e2fcbee3e4a24440c8ebe8aa2026b3bbb
Opcode Fuzzy Hash: 6d97942b4b7603c8db43bb55491f262dc327f23349ad49d2ddbad8683677c109
Instruction Fuzzy Hash: 32D19D74B40702ABEB14DBA4CC95F6EB3A5AF88708F108558F6169F3C1DAB1F901CB95

Function 110CA140 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 168windowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 110CA1C9
IsIconic.USER32(000019E5), ref: 110CA1D9
GetClientRect.USER32(000019E5,11181ECB), ref: 110CA1E8
GetSystemMetrics.USER32(00000000), ref: 110CA1FD
GetSystemMetrics.USER32(00000001), ref: 110CA204
IsIconic.USER32(000019E5), ref: 110CA234
GetWindowRect.USER32(000019E5,11181ECB), ref: 110CA243
SetWindowPos.USER32(?,00000000,11181ECB,000000FF,00000000,00000000,0000001D,00000000,?,00000001,11181ECB,00000002), ref: 110CA2F7

Strings

m_hWnd, xrefs: 110CA1B4, 110CA2DC
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CA1AF, 110CA2D7
m_eh, xrefs: 110CA18E
..\ctl32\nsmdlg.cpp, xrefs: 110CA189

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: RectWindow$IconicMetricsSystem$Client
String ID: ..\ctl32\nsmdlg.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_eh$m_hWnd
API String ID: 1498720339-1552842965
Opcode ID: 3d73986914d609eeaea83b3884d88d8a0497c699bba7ba8d127877062dadb9fc
Instruction ID: 24abde44bf8e52ea09d35a2e3cc3fe2b8bee096bcf6d70410d7c60972950a608
Opcode Fuzzy Hash: 3d73986914d609eeaea83b3884d88d8a0497c699bba7ba8d127877062dadb9fc
Instruction Fuzzy Hash: 62518D31E0022ADFDB11CFA8CC84FDEF7B9BB48758F1481A9E515A7280E675A980CF50

Function 1101F5B0 Relevance: 15.1, APIs: 10, Instructions: 54clipboardmemorywindowCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 1101F5D7
GlobalAlloc.KERNEL32(00002002,00000002), ref: 1101F5E7
GlobalLock.KERNEL32(00000000), ref: 1101F5F0
_memmove.LIBCMT ref: 1101F5F9
GlobalUnlock.KERNEL32(00000000), ref: 1101F602
EmptyClipboard.USER32 ref: 1101F608
SetClipboardData.USER32(00000001,00000000), ref: 1101F611
GlobalFree.KERNEL32(00000000), ref: 1101F61C
MessageBeep.USER32(00000030), ref: 1101F624
CloseClipboard.USER32 ref: 1101F62A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClipboardGlobal$AllocBeepCloseDataEmptyFreeLockMessageOpenUnlock_memmove
String ID:
API String ID: 3255624709-0
Opcode ID: 0cd85ee84de0f0eabd6e9d86846b828301ab76398c534cb94eb4e12aa498b46d
Instruction ID: 3e93ba2fa592e99353023f1270a8833cc391ce80e6ac7257477ed8ea97e92602
Opcode Fuzzy Hash: 0cd85ee84de0f0eabd6e9d86846b828301ab76398c534cb94eb4e12aa498b46d
Instruction Fuzzy Hash: 910196369011636BD3035B744C8CE5FBBACEF5934D7048879F62AC6115EA74C4058762

Function 111572A0 Relevance: 10.6, APIs: 7, Instructions: 105windowCOMMON

Download Yara Rule

APIs

IsIconic.USER32(?), ref: 11157347
ShowWindow.USER32(?,00000009), ref: 11157357
BringWindowToTop.USER32(?), ref: 11157361
IsWindow.USER32(00000000), ref: 111573A0
IsIconic.USER32(00000000), ref: 111573AB
ShowWindow.USER32(00000000,00000009), ref: 111573B8
BringWindowToTop.USER32(00000000), ref: 111573BF

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$BringIconicShow
String ID:
API String ID: 2588442158-0
Opcode ID: 6a12ddb43ec26d019ce36ab0d6575681f5b2569cd4afeef7f3b1d16a8792289a
Instruction ID: bb4012a2caf5ecb49819baba0dc11e5a0a7f49617467ab4708914747ccd99ede
Opcode Fuzzy Hash: 6a12ddb43ec26d019ce36ab0d6575681f5b2569cd4afeef7f3b1d16a8792289a
Instruction Fuzzy Hash: 2C31B575A04A299FD751CF54C846BAEF7B8FF45724F00816AE925D3380EB35A501CF91

Function 110241E0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 143windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 110242AD
IsIconic.USER32(00000000), ref: 110242CB
BringWindowToTop.USER32(00000000), ref: 110242E8

Part of subcall function 1110C740: InterlockedIncrement.KERNEL32(?), ref: 1110C744

Part of subcall function 110016E0: CloseHandle.KERNEL32(00000000,00000000,00000001,00000000), ref: 11001764

Strings

RDH::Dialog already created so restore, xrefs: 110242B7

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$BringCloseHandleIconicIncrementInterlocked
String ID: RDH::Dialog already created so restore
API String ID: 3707009992-3779292929
Opcode ID: 8f4ebd98abea1f4049e16bfb2095fcae73d3fd4eaef66c7ace68e1c4001126e9
Instruction ID: f59214875f01822882ab368e912e1c6bada028edf10351943a7a8fb770ee2f8a
Opcode Fuzzy Hash: 8f4ebd98abea1f4049e16bfb2095fcae73d3fd4eaef66c7ace68e1c4001126e9
Instruction Fuzzy Hash: 26517135A007069FE710DF6AD880B9AB7E9BF48318F858569E909C7680DB74F854CF51

Function 1115E061 Relevance: 7.6, APIs: 5, Instructions: 58COMMON

Download Yara Rule

APIs

IsDebuggerPresent.KERNEL32 ref: 11167FE7
SetUnhandledExceptionFilter.KERNEL32(00000000), ref: 11167FFC
UnhandledExceptionFilter.KERNEL32(111BCDC0), ref: 11168007
GetCurrentProcess.KERNEL32(C0000409), ref: 11168023
TerminateProcess.KERNEL32(00000000), ref: 1116802A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExceptionFilterProcessUnhandled$CurrentDebuggerPresentTerminate
String ID:
API String ID: 2579439406-0
Opcode ID: 29ab770786e8ac493107e9eda7e42105c9a61db3cc102465f9fa7ba7a280cc10
Instruction ID: 5f6083ef787702097cf8b18c6fd99932fcd8c81606b701da064da6005465e8ca
Opcode Fuzzy Hash: 29ab770786e8ac493107e9eda7e42105c9a61db3cc102465f9fa7ba7a280cc10
Instruction Fuzzy Hash: 1D21DFB591A3269FD702DFE8D9C5769FBA4BB4830CF50403AE93887248E7B05680CF06

Function 1109C2D0 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(000F01FF,?,1102FC83,00000000,00000000,?,D68DEC44,?,00000000), ref: 1109C2FD
OpenProcessToken.ADVAPI32(00000000,?,00000000), ref: 1109C304
LookupPrivilegeValueA.ADVAPI32(00000000,00000000,?), ref: 1109C315
AdjustTokenPrivileges.ADVAPI32(00000000,00000000,?,00000010), ref: 1109C339

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProcessToken$AdjustCurrentLookupOpenPrivilegePrivilegesValue
String ID:
API String ID: 2349140579-0
Opcode ID: 5fbede93267041afb07a53932415dc45556ef669340ecb84c070406a0081ffd3
Instruction ID: 423439a8b972858efce889d21e452d45444efcfd276f4be4d2700e153496032a
Opcode Fuzzy Hash: 5fbede93267041afb07a53932415dc45556ef669340ecb84c070406a0081ffd3
Instruction Fuzzy Hash: DD014CB1600219AFD710DF98CC89BAAF7BCEB48705F508469EA05D7284D7B16A04CB72

Function 110590F0 Relevance: 4.5, APIs: 3, Instructions: 19windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000400,?,00000000,00000000,?,?,1105978A,DuplicateHandle), ref: 11059101
FormatMessageA.KERNEL32(00001100,00000000,00000000,?,?,1105978A,DuplicateHandle), ref: 1105910F
LocalFree.KERNEL32(?,?,?,1105978A,DuplicateHandle), ref: 11059119

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorFormatFreeLastLocalMessage
String ID:
API String ID: 1365068426-0
Opcode ID: c4da030cc566985fed10b8ae72e49a46dab86cf533d5b385c533f073b0b7a5cb
Instruction ID: 5b7cf9c0659eada95368eb5e30aa7fe70508538aa6eda4fa9add4fab25305eb2
Opcode Fuzzy Hash: c4da030cc566985fed10b8ae72e49a46dab86cf533d5b385c533f073b0b7a5cb
Instruction Fuzzy Hash: D2D05E79684308BBE2159BD0CC4AFADB7ACD70CB16F200166FB01961C0DAB169008B76

Function 11032510 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 17clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(?), ref: 1103251B

Strings

Error Opening Clip, xrefs: 11032527

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClipboardOpen
String ID: Error Opening Clip
API String ID: 2793039342-3420635975
Opcode ID: 83f8a9692a96df86cc0e65605a2dd4a3fdd5d190c416adc9013ceda0d8979480
Instruction ID: 53cb5c7a72dfafafff781e7f5a2115f99f91efb22a132177b955a9f2e1ad24b1
Opcode Fuzzy Hash: 83f8a9692a96df86cc0e65605a2dd4a3fdd5d190c416adc9013ceda0d8979480
Instruction Fuzzy Hash: 9FD0A7BAE0163A278222DA99BC04886BBD8AB146D530000B1FE0587202EA30E91087D1

Function 11093520 Relevance: 3.0, APIs: 2, Instructions: 37memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000001,00000004,00000000,00000000,00000000,00000000,00000000,00000000,00000000,111E89B0,00000001), ref: 1109355B
EqualSid.ADVAPI32(1109392B,?,00000001,?,1109392B), ref: 11093569

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AllocateEqualInitialize
String ID:
API String ID: 1817187483-0
Opcode ID: cb111d76cc6ddb0cdfbcd0d1227ea24959156fde08543aa593202443ba1a4215
Instruction ID: 576f749789009b6f63bbafe42023118deef857e88eb22e76be97364225f5e421
Opcode Fuzzy Hash: cb111d76cc6ddb0cdfbcd0d1227ea24959156fde08543aa593202443ba1a4215
Instruction Fuzzy Hash: 72F05474E02118AFDB01DFE4C845ABDF7B8EB44204F808069ED1597144E7312A00CB56

Function 1100A1C0 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

DeviceIoControl.KERNEL32(?,FEFE0008,00000000,00000000,?,00004000,?,?), ref: 1100A204

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ControlDevice
String ID:
API String ID: 2352790924-0
Opcode ID: 453dabd6a744ac1c76e0f584565658db4116690c324a8b554c60a1462a98fadb
Instruction ID: d56e1409c268e1c2d729d2c2805c4eaed811c224a620cfa65b55070f66d52dec
Opcode Fuzzy Hash: 453dabd6a744ac1c76e0f584565658db4116690c324a8b554c60a1462a98fadb
Instruction Fuzzy Hash: A0F0FEB5500615AFCB14CF49DC48DE6B7E9FF88318F15C058FA089B221D631B906CFA0

Function 1102A4C0 Relevance: 45.8, APIs: 7, Strings: 19, Instructions: 259libraryloaderwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

LoadLibraryA.KERNEL32(-00000001,?,Bridge,Protocol,00000000,00000000), ref: 1102A527
GetLastError.KERNEL32(?,Bridge,Protocol,00000000,00000000), ref: 1102A53B
GetProcAddress.KERNEL32(00000000,br_open), ref: 1102A575
GetProcAddress.KERNEL32(00000000,br_close), ref: 1102A59A
GetProcAddress.KERNEL32(00000000,br_status), ref: 1102A5BF
LoadIconA.USER32(00000000,0000045C), ref: 1102A83A
Shell_NotifyIconA.SHELL32(00000001,000001E8,Bridge,LoadOnStartup,00000000,00000000), ref: 1102A856

Strings

br_status, xrefs: 1102A5B9, 1102A5D4
Debug, xrefs: 1102A658
Modem, xrefs: 1102A68B
ComPort, xrefs: 1102A63D
Password, xrefs: 1102A5E8
tcbr32.dll, xrefs: 1102A501, 1102A520, 1102A54B
com%d %d /A%d /B%d /D%d /M%s /P%s /T%d /N%s, xrefs: 1102A7AA
Inactivity, xrefs: 1102A72D
Protocol, xrefs: 1102A4DF
*MSN, xrefs: 1102A75E
br_open, xrefs: 1102A56F, 1102A58A
BaudRate, xrefs: 1102A624
ipbr32.dll, xrefs: 1102A4F5
CAPICAPICAPI, xrefs: 1102A6D9
PasswordFile, xrefs: 1102A717
Bridge, xrefs: 1102A4E4, 1102A5ED, 1102A629, 1102A642, 1102A65D, 1102A690, 1102A71C, 1102A732, 1102A763, 1102A7C6
LoadOnStartup, xrefs: 1102A7C1
CLIENT32.CPP, xrefs: 1102A585, 1102A5AA, 1102A5CF
br_close, xrefs: 1102A594, 1102A5AF

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$IconLoad$ErrorLastLibraryNotifyShell___wcstoi64
String ID: *MSN$BaudRate$Bridge$CAPICAPICAPI$CLIENT32.CPP$ComPort$Debug$Inactivity$LoadOnStartup$Modem$Password$PasswordFile$Protocol$br_close$br_open$br_status$com%d %d /A%d /B%d /D%d /M%s /P%s /T%d /N%s$ipbr32.dll$tcbr32.dll
API String ID: 1973887027-2044059647
Opcode ID: e4b9e22ab408712333c3e1f89361a1724bb224e909f94b02bf66b24fa24279ef
Instruction ID: 23ed2278c739ced6a00a445ad34cf05f3992334309605953d3f41a81a5025a93
Opcode Fuzzy Hash: e4b9e22ab408712333c3e1f89361a1724bb224e909f94b02bf66b24fa24279ef
Instruction Fuzzy Hash: 47912971E4061DEBE755DFA5CCC0FAEF7A5BB44708F9001A6E625B7280DB716A408B90

Function 111393E0 Relevance: 45.7, APIs: 13, Strings: 13, Instructions: 229registrylibraryloaderCOMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 1113943A
GetStockObject.GDI32(00000004), ref: 11139445
RegisterClassA.USER32(?), ref: 11139459
GetLastError.KERNEL32 ref: 111394CF
GetLastError.KERNEL32 ref: 111394EB
CreateWindowExA.USER32(00080020,NSMBlankWnd,Blank,88800000,?,?,?,?,00000000,00000000,00000000,00000000), ref: 11139555
SetWindowPos.USER32(?,00000001,00000000,00000000,00000000,00000000,00000053), ref: 111395BE
SetWindowPos.USER32(?,000000FF,00000000,00000000,00000000,00000000,00000053), ref: 111395ED
UpdateWindow.USER32(?), ref: 1113961B
GetProcAddress.KERNEL32(?,DwmEnableComposition), ref: 11139636
SetTimer.USER32(?,00000081,00000014,00000000), ref: 1113967A
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,110F5A5C), ref: 11139684
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,110F5A5C), ref: 111396A2

Strings

m_hWnd, xrefs: 1113959B, 111395D0, 1113960A, 11139660
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11139596, 111395CB, 11139605, 1113965B
BlankWnd x%x created, w=%d, h=%d, xrefs: 11139569
Error. BlankWnd not created, e=%d, xrefs: 111396A9
DwmEnableComposition, xrefs: 11139630
Error. RegisterClass(%s) failed, e=%d, xrefs: 111394F2
BlankWidth, xrefs: 1113947A
_debug, xrefs: 1113947F, 1113949C
Error setting blankwnd timer, e=%d, xrefs: 1113968B
Info. Class %s already registered, xrefs: 111394DC
BlankHeight, xrefs: 1113948B
NSMBlankWnd, xrefs: 11139452, 111394DB, 111394F1, 1113954B
Blank, xrefs: 11139546

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLastWindow$AddressClassCreateCursorLoadObjectProcRegisterStockTimerUpdate
String ID: Blank$BlankHeight$BlankWidth$BlankWnd x%x created, w=%d, h=%d$DwmEnableComposition$Error setting blankwnd timer, e=%d$Error. BlankWnd not created, e=%d$Error. RegisterClass(%s) failed, e=%d$Info. Class %s already registered$NSMBlankWnd$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 932975203-3566152235
Opcode ID: 38dc5643b9b4f47db0726ebfea6c30a0ba86dfd02d3f4a1ff48e588ee3da86df
Instruction ID: 5f0807ccd17951342d3a60113474b30c90d86c4c35d9270eb7c924cc7150441f
Opcode Fuzzy Hash: 38dc5643b9b4f47db0726ebfea6c30a0ba86dfd02d3f4a1ff48e588ee3da86df
Instruction Fuzzy Hash: CB81C475A0031AAFE310DFA5DC81FEEF7B8BB44719F104529F259A7280E7716940CBA5

Function 1100C7E0 Relevance: 45.7, APIs: 16, Strings: 10, Instructions: 185libraryloaderthreadCOMMON

Download Yara Rule

APIs

InitializeCriticalSection.KERNEL32(00000010), ref: 1100C837
InitializeCriticalSection.KERNEL32(00000028), ref: 1100C83D
InitializeCriticalSection.KERNEL32(00000040), ref: 1100C843
InitializeCriticalSection.KERNEL32(00000058), ref: 1100C849
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 1100C853
GetVersion.KERNEL32 ref: 1100C95E
LoadLibraryA.KERNEL32(msacm32.dll), ref: 1100C96F
GetProcAddress.KERNEL32(00000000,acmStreamOpen), ref: 1100C98B
GetProcAddress.KERNEL32(?,acmStreamClose), ref: 1100C99F
GetProcAddress.KERNEL32(?,acmStreamSize), ref: 1100C9B3
GetProcAddress.KERNEL32(?,acmStreamPrepareHeader), ref: 1100C9C7
GetProcAddress.KERNEL32(?,acmStreamConvert), ref: 1100C9DB
GetProcAddress.KERNEL32(?,acmStreamUnprepareHeader), ref: 1100C9EF
CreateThread.KERNEL32(00000000,00002000,Function_0000C3A0,00000000,00000000,?), ref: 1100CA0A
SetThreadPriority.KERNEL32(00000000,00000001), ref: 1100CA30
CloseHandle.KERNEL32(00000000), ref: 1100CA37

Strings

acmStreamUnprepareHeader, xrefs: 1100C9E3
acmStreamSize, xrefs: 1100C9A7
hAudio, xrefs: 1100CA20
acmStreamClose, xrefs: 1100C999
acmStreamConvert, xrefs: 1100C9D5
msacm32.dll, xrefs: 1100C964
..\ctl32\AUDIO.CPP, xrefs: 1100C868, 1100CA1B
acmStreamPrepareHeader, xrefs: 1100C9BB
acmStreamOpen, xrefs: 1100C985
idata->hEvent, xrefs: 1100C86D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalInitializeSection$CreateThread$CloseEventHandleLibraryLoadPriorityVersion
String ID: ..\ctl32\AUDIO.CPP$acmStreamClose$acmStreamConvert$acmStreamOpen$acmStreamPrepareHeader$acmStreamSize$acmStreamUnprepareHeader$hAudio$idata->hEvent$msacm32.dll
API String ID: 81955155-2117072583
Opcode ID: 7fcc779d5cdb42f66596ae1c418ff99e562e6b2337ca0e7b3bb911804ff503c4
Instruction ID: f4c7c1c2985f4ea65a77132b1b6ca62375c4ec939218ea5a1d89424e5fa962cb
Opcode Fuzzy Hash: 7fcc779d5cdb42f66596ae1c418ff99e562e6b2337ca0e7b3bb911804ff503c4
Instruction Fuzzy Hash: ED6192B5E40705AFEB10DF75CC44BDAF7E4AF44314F10896DEA6AD7280EA70A640CB51

Function 11005350 Relevance: 44.0, APIs: 16, Strings: 9, Instructions: 214windowCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D2E0: __itow.LIBCMT ref: 1105D305

GetObjectA.GDI32(?,0000003C,?), ref: 11005425
wsprintfA.USER32 ref: 1100547D
DeleteObject.GDI32(?), ref: 110054D2
DeleteObject.GDI32(?), ref: 110054DB
SelectObject.GDI32(?,?), ref: 110054F2
DeleteObject.GDI32(?), ref: 110054F8
DeleteDC.GDI32(?), ref: 110054FE
SelectObject.GDI32(?,?), ref: 1100550F
DeleteObject.GDI32(?), ref: 11005518
DeleteDC.GDI32(?), ref: 1100551E
DeleteObject.GDI32(?), ref: 1100552F
DeleteObject.GDI32(?), ref: 1100555A
DeleteObject.GDI32(?), ref: 11005578
DeleteObject.GDI32(?), ref: 11005581
ShowWindow.USER32(?,00000009), ref: 110055AF
PostQuitMessage.USER32(00000000), ref: 110055B7

Strings

Annotate, xrefs: 11005378, 11005396, 110053B4, 110053D2, 110053F0, 1100540E, 11005494
PenColour, xrefs: 11005391
PenWidth, xrefs: 110053CD
FillColour, xrefs: 110053EB
FillStyle, xrefs: 11005409
Font, xrefs: 1100548F
%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s, xrefs: 11005477
PenStyle, xrefs: 110053AF
Tool, xrefs: 11005373

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Delete$Select$MessagePostQuitShowWindow__itowwsprintf
String ID: %d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%d,%s$Annotate$FillColour$FillStyle$Font$PenColour$PenStyle$PenWidth$Tool
API String ID: 3442046557-770455996
Opcode ID: 3e6a3d5ed2b84a027c8dc14d4220e6f92123b4ac825ae70bba36715c00e4d783
Instruction ID: 2a6d045e964b36a24251c125f74dd0e3cb5f62d49ac170c8fdd37657f418133f
Opcode Fuzzy Hash: 3e6a3d5ed2b84a027c8dc14d4220e6f92123b4ac825ae70bba36715c00e4d783
Instruction Fuzzy Hash: 04814B75A00605AFE764DBA5C890EABF7F9AF8C704F10450DF69A97341DA71F841CB60

Function 1101E200 Relevance: 44.0, APIs: 23, Strings: 2, Instructions: 210COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 1101E240
GetDlgItem.USER32(00000000,000013A2), ref: 1101E279
GetWindowRect.USER32(00000000), ref: 1101E27C
GetDlgItem.USER32(00000000,0000139F), ref: 1101E28B
GetWindowRect.USER32(00000000), ref: 1101E28E
GetDlgItem.USER32(00000000,00000002), ref: 1101E2AD
GetDlgItem.USER32(00000000,000013B2), ref: 1101E2C6
GetDlgItem.USER32(00000000,000017DD), ref: 1101E2DF
GetDlgItem.USER32(00000000,000013A9), ref: 1101E2F8
GetDlgItem.USER32(00000000,?), ref: 1101E313
GetDlgItem.USER32(00000000,000013A2), ref: 1101E32C
GetDlgItem.USER32(00000000,000013A4), ref: 1101E345
GetDlgItem.USER32(00000000,0000139C), ref: 1101E35E

Part of subcall function 110CC1B0: GetWindowRect.USER32(00000000,?), ref: 110CC22B
Part of subcall function 110CC1B0: GetWindowRect.USER32(?,?), ref: 110CC239
Part of subcall function 110CC1B0: MapWindowPoints.USER32(00000000,?,00000018,00000002), ref: 110CC274

GetDlgItem.USER32(00000000,0000139D), ref: 1101E377
GetDlgItem.USER32(00000000,0000139F), ref: 1101E390
GetDlgItem.USER32(00000000,000013A8), ref: 1101E3A9
GetDlgItem.USER32(00000000,000013AB), ref: 1101E3C2
GetDlgItem.USER32(00000000,000013B1), ref: 1101E3DB
GetDlgItem.USER32(00000000,000013C2), ref: 1101E3F4
GetDlgItem.USER32(00000000,000013C3), ref: 1101E40D
GetDlgItem.USER32(00000000,000013BE), ref: 1101E426
GetDlgItem.USER32(00000000,000013CA), ref: 1101E43F
GetDlgItem.USER32(00000000,000013C7), ref: 1101E458

Strings

m_hWnd, xrefs: 1101E225
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101E220

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Item$Window$Rect$Points
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2742103943-2830328467
Opcode ID: 676a32067ccf11b73a815100f8de6118f4276d8d78f7df60198a5be77d182fde
Instruction ID: 656d409aa734af2047cfdc67ee72673b856d37ffada8ea53e0dcd01f586abb93
Opcode Fuzzy Hash: 676a32067ccf11b73a815100f8de6118f4276d8d78f7df60198a5be77d182fde
Instruction Fuzzy Hash: 7C7111B5A40705ABD664EBB6CC95F9BF3AEAF84704F008809A65A976D0CE74B940CF50

Function 11003770 Relevance: 40.7, APIs: 27, Instructions: 240COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 110037CF
InflateRect.USER32(?,000000FF,000000FF), ref: 110037EA
GetSysColor.USER32(00000010), ref: 110037FD
GetSysColor.USER32(00000010), ref: 11003814
GetSysColor.USER32(00000014), ref: 1100382B
GetSysColor.USER32(00000014), ref: 11003842
GetSysColor.USER32(00000014), ref: 11003865
GetSysColor.USER32(00000014), ref: 1100387C
GetSysColor.USER32(00000010), ref: 11003893
GetSysColor.USER32(00000010), ref: 110038AA
GetSysColor.USER32(00000004), ref: 110038C1
SetBkColor.GDI32(00000000,00000000), ref: 110038C8
InflateRect.USER32(?,000000FE,000000FD), ref: 110038D6
GetSysColor.USER32(00000010), ref: 110038F2
CreatePen.GDI32(?,00000001,00000000), ref: 110038FB
SelectObject.GDI32(00000000,00000000), ref: 11003909
MoveToEx.GDI32(00000000,?,?,00000000), ref: 11003922
LineTo.GDI32(00000000,?,?), ref: 11003936
SelectObject.GDI32(00000000,?), ref: 11003944
DeleteObject.GDI32(?), ref: 1100394E
GetSysColor.USER32(00000014), ref: 1100395C
CreatePen.GDI32(?,00000001,00000000), ref: 11003965
SelectObject.GDI32(00000000,00000000), ref: 11003972
MoveToEx.GDI32(00000000,?,?,00000000), ref: 1100398E
LineTo.GDI32(00000000,?,?), ref: 110039A5
SelectObject.GDI32(00000000,?), ref: 110039B3
DeleteObject.GDI32(00000000), ref: 110039BA

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$CreateDeleteInflateLineMoveRect
String ID:
API String ID: 1903512896-0
Opcode ID: 2993ca797b480a36e0b8dc24a84414bbca3409ea6e2fe5b3965c3f87bb86b1af
Instruction ID: 356bd848297a324bcbdf8701764979560099bad7f12f40618653e3669cb5a007
Opcode Fuzzy Hash: 2993ca797b480a36e0b8dc24a84414bbca3409ea6e2fe5b3965c3f87bb86b1af
Instruction Fuzzy Hash: 598141B5A0030AAFD714DFA5CC85EAFF7B9EF88314F104A18E611A6285D671E944CB61

Function 110FD220 Relevance: 40.5, APIs: 7, Strings: 16, Instructions: 207synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

Part of subcall function 110EB3C0: RegCreateKeyExA.ADVAPI32(?,?,00000000,00000000,1100AB08,?,?,?,00000000,?,?,?,?,?,110EBB0C,?), ref: 110EB3EB

GetTickCount.KERNEL32 ref: 110FD33B
WaitForSingleObject.KERNEL32(00000000,000000FF), ref: 110FD348
CloseHandle.KERNEL32(00000000), ref: 110FD355
GetTickCount.KERNEL32 ref: 110FD35B
wsprintfA.USER32 ref: 110FD41E

Strings

Error %d opening key, xrefs: 110FD2CB
Client, xrefs: 110FD260
Waited %d ms for last devcon, xrefs: 110FD367
Software\NetSupport Ltd\Client32, xrefs: 110FD2AA
%s HID*, xrefs: 110FD486
TraceFile, xrefs: 110FD3A0
"%s" %s %s HID*, xrefs: 110FD418
_debug, xrefs: 110FD383, 110FD3A5
DisableHIDCode, xrefs: 110FD25B
DisabledHID, xrefs: 110FD2DF, 110FD4C0, 110FD4CC
D, xrefs: 110FD461
DisableHidDevices(%d), xrefs: 110FD289
nsdevcon64.exe, xrefs: 110FD3BF, 110FD4D8
Error creating process %s, xrefs: 110FD4D9
nsdevcon.exe, xrefs: 110FD3C6, 110FD3CD, 110FD3F3
Trace, xrefs: 110FD37E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CloseCreateHandleObjectSingleWait__wcstoi64wsprintf
String ID: "%s" %s %s HID*$%s HID*$Client$D$DisableHIDCode$DisableHidDevices(%d)$DisabledHID$Error %d opening key$Error creating process %s$Software\NetSupport Ltd\Client32$Trace$TraceFile$Waited %d ms for last devcon$_debug$nsdevcon.exe$nsdevcon64.exe
API String ID: 3492922940-2801557662
Opcode ID: 891ec93e71480b60544215e3440b6777bc9212fce19fb15dcae776dd78f48584
Instruction ID: 96585a1094de27a4c87063933bac495094e607cf05c72fb9e80209eaa7f1f85d
Opcode Fuzzy Hash: 891ec93e71480b60544215e3440b6777bc9212fce19fb15dcae776dd78f48584
Instruction Fuzzy Hash: 7671FDB5E0125B7BE720DF71DC85FEEFBA4AB04708F504195E918A61C1EB707940CBA2

Function 1111E2E0 Relevance: 39.0, APIs: 16, Strings: 6, Instructions: 480windowCOMMON

Download Yara Rule

APIs

PeekMessageA.USER32(?,00000000,00000200,0000020D,00000003), ref: 1111E4EC

Strings

Warning: wd_seq=0, xrefs: 1111E360
Client, xrefs: 1111E42E
", xrefs: 1111E5CC
Silent, xrefs: 1111E429
Warning: wd_seq=%d, seq=%d, xrefs: 1111E380
Warning: wd_seq (%d) != seq (%d), xrefs: 1111E3C7

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePeek
String ID: "$Client$Silent$Warning: wd_seq (%d) != seq (%d)$Warning: wd_seq=%d, seq=%d$Warning: wd_seq=0
API String ID: 2222842502-1700365359
Opcode ID: e740bf6a65ac77c40eaae8c09bfa67a3833c1eef811d00495e0f14c090392d84
Instruction ID: 8cb0625305a70868322fd482ae71c891baa6f284ae5a365f95656e67f90cbda9
Opcode Fuzzy Hash: e740bf6a65ac77c40eaae8c09bfa67a3833c1eef811d00495e0f14c090392d84
Instruction Fuzzy Hash: 28F1D47D901225ABDB11CFB4DD84B9EF775AF48308F144579ED099F249FA31AA00CBA2

Function 1115A0F0 Relevance: 38.7, APIs: 13, Strings: 9, Instructions: 249sleepCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1115A1C7
wsprintfA.USER32 ref: 1115A236
FindWindowA.USER32(?,00000000), ref: 1115A28E
GetForegroundWindow.USER32 ref: 1115A29E
GetLastError.KERNEL32 ref: 1115A2D8
GetTickCount.KERNEL32 ref: 1115A302
FindWindowA.USER32(00000000,?), ref: 1115A32B
Sleep.KERNEL32(00000064), ref: 1115A339
GetTickCount.KERNEL32 ref: 1115A33F
Sleep.KERNEL32(000007D0), ref: 1115A354
SetForegroundWindow.USER32(?), ref: 1115A35E

Strings

PCIVideoSlave32, xrefs: 1115A141
PCIVideo.exe /x /w"%s", xrefs: 1115A21A
SlaveWindow, xrefs: 1115A170
MMPlayer, xrefs: 1115A134, 1115A175, 1115A1E5
Here 2 (%d), xrefs: 1115A2DF
PCIVideoSlave:0x%x, xrefs: 1115A182
PCIVideoVi.exe /x /w"%s", xrefs: 1115A209
SlavePlayer, xrefs: 1115A1E0
SlaveClass, xrefs: 1115A12F

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$CountFindForegroundSleepTickwsprintf$ErrorLast
String ID: Here 2 (%d)$MMPlayer$PCIVideo.exe /x /w"%s"$PCIVideoSlave32$PCIVideoSlave:0x%x$PCIVideoVi.exe /x /w"%s"$SlaveClass$SlavePlayer$SlaveWindow
API String ID: 4235248531-48387523
Opcode ID: 5813e151dda5dced8821567c9ee70cd9d189aab536b3622d9f230176bb26409b
Instruction ID: deaf33596e760af3589d889dd573afc7e3c196690bcd6475ffb82d3da36de3b0
Opcode Fuzzy Hash: 5813e151dda5dced8821567c9ee70cd9d189aab536b3622d9f230176bb26409b
Instruction Fuzzy Hash: D791C475A0025A9FDB50CFA8D880B9EFBB4FF49304F108169E919DF345E770A904CB54

Function 110F4220 Relevance: 38.7, APIs: 14, Strings: 8, Instructions: 185serviceCOMMON

Download Yara Rule

APIs

OpenSCManagerA.ADVAPI32(00000000,00000000,000F003F,?,?,?,?,00000000), ref: 110F4276
OpenServiceA.ADVAPI32(00000000,?,00000024,?,?,?,?,?,00000000), ref: 110F429C
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,1102DB0F,client32,000007D0), ref: 110F42AB
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000), ref: 110F42C1
QueryServiceStatus.ADVAPI32(00000000,?,?,?,?,?,00000000,?,?,?,?,?,?,?,?,1102DB0F), ref: 110F42DF
ControlService.ADVAPI32(00000000,00000001,?,?,?,?,?,00000000), ref: 110F42FB
GetLastError.KERNEL32(?,?,?,?,00000000,?,?,?,?,?,?,?,?,1102DB0F,client32,000007D0), ref: 110F4305
CloseServiceHandle.ADVAPI32(00000000,?,?,?,?,?,?,?,00000000), ref: 110F4321
CloseServiceHandle.ADVAPI32(?,?,?,?,?,?,?,?,00000000), ref: 110F4327

Strings

Cannot stop %s service, error %d, xrefs: 110F430D
Reducing restart %s timeout as we're quitting, xrefs: 110F4368
%s stopping, xrefs: 110F43F2
stop service %s (timeout %d), xrefs: 110F4260
client32, xrefs: 110F4235, 110F43B0
Error getting %s status, err=%d, xrefs: 110F43DA
Cannot open %s service, error %d, xrefs: 110F42B3
%s stopped, xrefs: 110F43EA

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Service$CloseHandle$ErrorLastOpen$ControlManagerQueryStatus
String ID: %s stopped$%s stopping$Cannot open %s service, error %d$Cannot stop %s service, error %d$Error getting %s status, err=%d$Reducing restart %s timeout as we're quitting$client32$stop service %s (timeout %d)
API String ID: 3781003154-2274875639
Opcode ID: 1b7832cca0da9bf1be9dd2cd0efeb57bb57338ffa97514bdd0c797722a3e9a6c
Instruction ID: dfff35b4701726c5749d4997de5618efe3bc55a7157755a2602fb6128e3542d8
Opcode Fuzzy Hash: 1b7832cca0da9bf1be9dd2cd0efeb57bb57338ffa97514bdd0c797722a3e9a6c
Instruction Fuzzy Hash: FA51EA79E0012AABDB01DFA49C81BFDF7B8EB48718F518069ED15E7140EA31684587B2

Function 110855D0 Relevance: 38.7, APIs: 12, Strings: 10, Instructions: 161libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(?,00000001,0000DD7C), ref: 1108565C
GetModuleFileNameA.KERNEL32(?,?,00000104), ref: 1108567A
LoadLibraryA.KERNEL32(?), ref: 110856BC
GetProcAddress.KERNEL32(?,CipherServer_Create), ref: 110856D7
GetProcAddress.KERNEL32(?,CipherServer_Destroy), ref: 110856EC
GetProcAddress.KERNEL32(00000000,CipherServer_GetInfoBlock), ref: 110856FD
GetProcAddress.KERNEL32(?,CipherServer_OpenSession), ref: 1108570E
GetProcAddress.KERNEL32(?,CipherServer_CloseSession), ref: 1108571F
GetProcAddress.KERNEL32(00000000,CipherServer_EncryptBlocks), ref: 11085730

Strings

CipherServer_DecryptBlocks, xrefs: 1108573B
CipherServer_EncryptBlocks, xrefs: 1108572A
CipherServer_Destroy, xrefs: 110856E6
CipherServer_ResetSession, xrefs: 1108575D
CryptPak.dll, xrefs: 1108562B, 1108568E
CipherServer_Create, xrefs: 110856D1
CipherServer_CloseSession, xrefs: 11085719
CipherServer_GetInfoBlock, xrefs: 110856F7
CipherServer_OpenSession, xrefs: 11085708
CipherServer_GetRandomData, xrefs: 1108574C

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$FileModuleName
String ID: CipherServer_CloseSession$CipherServer_Create$CipherServer_DecryptBlocks$CipherServer_Destroy$CipherServer_EncryptBlocks$CipherServer_GetInfoBlock$CipherServer_GetRandomData$CipherServer_OpenSession$CipherServer_ResetSession$CryptPak.dll
API String ID: 2201880244-3035937465
Opcode ID: e0dba0d99c10548116c81b986336f3d4d6c5528f683ed99da40b47e82b81d932
Instruction ID: 19117c612bab63f47e547f4b6bce133bd536c0413643b44441967bf9c66e6910
Opcode Fuzzy Hash: e0dba0d99c10548116c81b986336f3d4d6c5528f683ed99da40b47e82b81d932
Instruction Fuzzy Hash: 3451DE74E0471BAFC714EF39DC90A9AFBE8AF58304B2585AAD895CB244EB71E440CF51

Function 110ED730 Relevance: 36.2, APIs: 24, Instructions: 222windowmemoryCOMMON

Download Yara Rule

APIs

GetObjectA.GDI32(?,00000018,?), ref: 110ED74E
GetStockObject.GDI32(0000000F), ref: 110ED762
GetDC.USER32(00000000), ref: 110ED7DA
SelectPalette.GDI32(00000000,00000000,00000000), ref: 110ED7EB
RealizePalette.GDI32(00000000), ref: 110ED7F1
GlobalAlloc.KERNEL32(00000042,?,00000000), ref: 110ED80C
SelectPalette.GDI32(00000000,?,00000001), ref: 110ED820
RealizePalette.GDI32(00000000), ref: 110ED823
ReleaseDC.USER32(00000000,00000000), ref: 110ED82B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Palette$ObjectRealizeSelect$AllocGlobalReleaseStock
String ID:
API String ID: 1969595663-0
Opcode ID: 460c3ef96ebe8ed115c01ac097ffa682f3726c3033c725e46577f46786f58dec
Instruction ID: 199691176bb6e4e8484401d9423c23e300feb182185e9bd8880e2cea6550b7f3
Opcode Fuzzy Hash: 460c3ef96ebe8ed115c01ac097ffa682f3726c3033c725e46577f46786f58dec
Instruction Fuzzy Hash: 9371A3B5E01129AFDB01DFA9CC88BEEB7B9FF88714F148056FA15E7244D77499008BA1

Function 1100C3A0 Relevance: 35.3, APIs: 15, Strings: 5, Instructions: 332sleepCOMMON

Download Yara Rule

APIs

InterlockedIncrement.KERNEL32(111E7A64), ref: 1100C3BD
WaitForMultipleObjects.KERNEL32(?,?,00000000,?), ref: 1100C483
GetLastError.KERNEL32(?,?,00000000,?), ref: 1100C490
Sleep.KERNEL32(000003E8), ref: 1100C4B4
GetTickCount.KERNEL32 ref: 1100C4FD
_free.LIBCMT ref: 1100C53A

Part of subcall function 1100B3A0: EnterCriticalSection.KERNEL32(?,Audio,DisableSounds,00000000,00000000,D68DEC44), ref: 1100B42B
Part of subcall function 1100B3A0: CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 1100B448
Part of subcall function 1100B3A0: _calloc.LIBCMT ref: 1100B479
Part of subcall function 1100B3A0: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 1100B49F
Part of subcall function 1100B3A0: LeaveCriticalSection.KERNEL32(?), ref: 1100B4D9

_free.LIBCMT ref: 1100C6C1
GetTickCount.KERNEL32 ref: 1100C6C9
EnterCriticalSection.KERNEL32(?,?,?,00000000,?), ref: 1100C6E5
waveInUnprepareHeader.WINMM(?,00000000,00000020,?,?,00000000,?), ref: 1100C6F2
waveInPrepareHeader.WINMM(?,00000000,00000020,?,?,00000000,?), ref: 1100C6FF
waveInAddBuffer.WINMM(?,00000000,00000020,?,?,00000000,?), ref: 1100C70C
LeaveCriticalSection.KERNEL32(?,?,?,00000000,?), ref: 1100C713
_free.LIBCMT ref: 1100C773
InterlockedDecrement.KERNEL32(111E7A64), ref: 1100C7B6

Strings

Audio, xrefs: 1100C3AB
Error %d waiting for audio (nEvents=%d), xrefs: 1100C4A2
Vista AudioCap FreeInstance (pAudioCap=%p), xrefs: 1100C791
Audiothread started, threadcnt=%d, xrefs: 1100C3C9
Audiothread stopped, threadcnt=%d, xrefs: 1100C7C3

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$_freewave$CountCreateEnterHeaderInterlockedLeaveTick$BufferDecrementErrorEventFileIncrementLastMultipleObjectsPrepareSleepUnprepareWait_calloc
String ID: Audio$Audiothread started, threadcnt=%d$Audiothread stopped, threadcnt=%d$Error %d waiting for audio (nEvents=%d)$Vista AudioCap FreeInstance (pAudioCap=%p)
API String ID: 4283032484-3268596948
Opcode ID: 5360b081cdcc0cae1b2eeb5ab1da0b56bab3a17f430dd1451f91ac15dfdf6f7c
Instruction ID: 58ce79c199020602ae64d90329c6aeb425579136910500668d9b9d5c78b180f3
Opcode Fuzzy Hash: 5360b081cdcc0cae1b2eeb5ab1da0b56bab3a17f430dd1451f91ac15dfdf6f7c
Instruction Fuzzy Hash: 28C1E674E00717ABF715CF64CD84BAEFBA4BF45388F148299E91996241EB30B590CBD1

Function 1100D260 Relevance: 33.5, APIs: 11, Strings: 8, Instructions: 263COMMON

Download Yara Rule

Strings

Audio, xrefs: 1100D398
Error. waveOutPrepareHeader e=%d. Closing audio out, xrefs: 1100D49E
SoundVol, xrefs: 1100D393
Error. hash (%d) != format_hash (%d), xrefs: 1100D29D
Error. hwo=0, xrefs: 1100D3EA
Error %d. hwo2=0, iwf=%p, xrefs: 1100D368
..\ctl32\AUDIO.CPP, xrefs: 1100D44A
Error. waveOutWrite e=%d. Closing audio out, xrefs: 1100D515

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: ..\ctl32\AUDIO.CPP$Audio$Error %d. hwo2=0, iwf=%p$Error. hash (%d) != format_hash (%d)$Error. hwo=0$Error. waveOutPrepareHeader e=%d. Closing audio out$Error. waveOutWrite e=%d. Closing audio out$SoundVol
API String ID: 0-2427476101
Opcode ID: 1646ef592daf6671c8b45367ea5fad082a73c4034ad84a29451cb7860c824a85
Instruction ID: ecd48881f083ecf1e5d3bec2bb2324b203b01ee468f829974aa413e95cce5bc0
Opcode Fuzzy Hash: 1646ef592daf6671c8b45367ea5fad082a73c4034ad84a29451cb7860c824a85
Instruction Fuzzy Hash: 5B91B575E0060AAFD714DF69D841BAEFBE4FB48364F10862AF925D3780E731A550CBA1

Function 11106220 Relevance: 33.5, APIs: 14, Strings: 5, Instructions: 213libraryloaderCOMMON

Download Yara Rule

APIs

OpenEventA.KERNEL32(00000002,00000000,nsm_gina_sas,00000009), ref: 111062FA
CloseHandle.KERNEL32(00000000), ref: 11106309
GetSystemDirectoryA.KERNEL32(?,000000F7), ref: 1110631B
LoadLibraryA.KERNEL32(?), ref: 11106351
GetProcAddress.KERNEL32(?,GrabKM), ref: 1110637E
GetProcAddress.KERNEL32(?,LoggedOn), ref: 11106396
FreeLibrary.KERNEL32(?), ref: 111063BB

Part of subcall function 1110C790: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,11001763,00000000,00000001,00000000), ref: 1110C7A7
Part of subcall function 1110C790: CreateThread.KERNEL32(00000000,11001763,00000001,?,00000000,00000001), ref: 1110C7CA
Part of subcall function 1110C790: WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,11001763,00000000,00000001,00000000), ref: 1110C7F7
Part of subcall function 1110C790: CloseHandle.KERNEL32(?,?,?,?,?,11001763,00000000,00000001,00000000), ref: 1110C801

GetStockObject.GDI32(0000000D), ref: 111063CF
GetObjectA.GDI32(00000000,0000003C,?), ref: 111063DF
InitializeCriticalSection.KERNEL32(0000003C), ref: 111063FB
InitializeCriticalSection.KERNEL32(111EB23C), ref: 11106406

Part of subcall function 11104780: LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11185CA6,000000FF), ref: 11104853
Part of subcall function 11104780: LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111048A2

CloseHandle.KERNEL32(00000000,11100340,00000001,00000000), ref: 11106449

Part of subcall function 1109D870: GetCurrentProcess.KERNEL32(00020008,00000000,?,?,110F5D34,00000001,1113DD5F,_debug,TraceCopyData,00000000,00000000), ref: 1109D891
Part of subcall function 1109D870: OpenProcessToken.ADVAPI32(00000000,?,?,110F5D34,00000001,1113DD5F,_debug,TraceCopyData,00000000,00000000), ref: 1109D898
Part of subcall function 1109D870: CloseHandle.KERNEL32(00000000,00000000), ref: 1109D8B7

CloseHandle.KERNEL32(00000000,11100340,00000001,00000000), ref: 1110649A
CloseHandle.KERNEL32(00000000,11100340,00000001,00000000), ref: 111064EF

Strings

nsm_gina_sas, xrefs: 111062E4
LoggedOn, xrefs: 11106390
GrabKM, xrefs: 11106378
LPT1, xrefs: 111062D9
\pcigina, xrefs: 11106330

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$Library$LoadObject$AddressCreateCriticalEventInitializeOpenProcProcessSection$CurrentDirectoryFreeSingleStockSystemThreadTokenWait
String ID: GrabKM$LPT1$LoggedOn$\pcigina$nsm_gina_sas
API String ID: 2879599740-403456261
Opcode ID: 00f1cfcc98c25c79a4e81ad9a78d5c7645bc4e4a9ebb92bd44ef34a2ee12feee
Instruction ID: 8bba35957b3f3790df15e81a0fae84b5b4a390b78b0c2e717f0ef106a9243882
Opcode Fuzzy Hash: 00f1cfcc98c25c79a4e81ad9a78d5c7645bc4e4a9ebb92bd44ef34a2ee12feee
Instruction Fuzzy Hash: 308181B1E017569FDB11CFB48C88B9EFBE4BB48308F208969E56DD7281E770A544CB51

Function 111403A0 Relevance: 31.8, APIs: 15, Strings: 3, Instructions: 281COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 11140408
RaiseException.KERNEL32(?,00000000,00000000,00000000), ref: 11140455

Strings

Support\, xrefs: 1114059A
_%04d_%02d_%02d_%02d%02d%02d.dmp, xrefs: 11140555
%d., xrefs: 11140524

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountExceptionRaiseTick
String ID: %d.$Support\$_%04d_%02d_%02d_%02d%02d%02d.dmp
API String ID: 473833368-1432287636
Opcode ID: 282e503ede3defe267f775b39119fa41e34fa1bdb4436504b24f740421dbda8b
Instruction ID: e2e71b7d84c770fabcfc1ef4b8603356f1ba9c8bb038dc5dbb9d8bd6d9d1fb64
Opcode Fuzzy Hash: 282e503ede3defe267f775b39119fa41e34fa1bdb4436504b24f740421dbda8b
Instruction Fuzzy Hash: D0A11A7190466A9FD722CF75CC45BEAF7F4FF48B04F208269E959A7280E730A944CB91

Function 111037D0 Relevance: 31.7, APIs: 14, Strings: 4, Instructions: 239libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(psapi.dll,D68DEC44,00000001,?,?,00000000,11185AE6,000000FF,?,111046FF,00000000,?,?,?), ref: 1110380D

Part of subcall function 11134C00: GetVersion.KERNEL32(00000000,001D8F32,00000000), ref: 11134C23
Part of subcall function 11134C00: GetModuleHandleA.KERNEL32(ntdll.dll), ref: 11134C44
Part of subcall function 11134C00: GetProcAddress.KERNEL32(00000000,VerSetConditionMask), ref: 11134C54
Part of subcall function 11134C00: GetModuleHandleA.KERNEL32(KERNEL32.DLL), ref: 11134C71
Part of subcall function 11134C00: GetProcAddress.KERNEL32(00000000,VerifyVersionInfoA), ref: 11134C7D

FreeLibrary.KERNEL32(00000000,?,111046FF,00000000,?,?,?), ref: 1110385F
LoadLibraryA.KERNEL32(Kernel32.dll), ref: 11103896
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 1110391F
GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 111039A1
SetLastError.KERNEL32(00000078), ref: 111039C3
SetLastError.KERNEL32(00000078), ref: 111039D0
OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 111039E9
OpenProcessToken.ADVAPI32(00000000,00000008,?,?,?,?,?,?,111046FF), ref: 11103A50
GetTokenInformation.ADVAPI32(?,0000000C(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,111046FF), ref: 11103A77
CloseHandle.KERNEL32(?,?,?,?,?,?,111046FF), ref: 11103ACF

Part of subcall function 111035F0: GetTickCount.KERNEL32 ref: 1110361E
Part of subcall function 111035F0: EnterCriticalSection.KERNEL32(111EB23C), ref: 11103627
Part of subcall function 111035F0: GetTickCount.KERNEL32 ref: 1110362D
Part of subcall function 111035F0: GetTickCount.KERNEL32 ref: 11103680
Part of subcall function 111035F0: LeaveCriticalSection.KERNEL32(111EB23C), ref: 11103689

Part of subcall function 110F4030: WaitForSingleObject.KERNEL32(?,00000000,?,?,11104EA5), ref: 110F4041
Part of subcall function 110F4030: InterlockedExchange.KERNEL32(?,00000000), ref: 110F404D
Part of subcall function 110F4030: CloseHandle.KERNEL32(00000000), ref: 110F4058
Part of subcall function 110F4030: InterlockedIncrement.KERNEL32(111EB22C), ref: 110F4085

CloseHandle.KERNEL32(00000000), ref: 11103AD6
FreeLibrary.KERNEL32(00000000,?,?,?,?,111046FF), ref: 11103B26
FreeLibrary.KERNEL32(00000000,?,?,?,?,111046FF), ref: 11103B31

Strings

EnumProcesses, xrefs: 11103909
Kernel32.dll, xrefs: 11103891
ProcessIdToSessionId, xrefs: 1110399B
psapi.dll, xrefs: 11103808

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: HandleLibrary$AddressProc$CloseCountFreeTick$CriticalErrorInterlockedLastLoadModuleOpenProcessSectionToken$EnterExchangeIncrementInformationLeaveObjectSingleVersionWait
String ID: EnumProcesses$Kernel32.dll$ProcessIdToSessionId$psapi.dll
API String ID: 2847773570-617439319
Opcode ID: 4bae4a6a99eb3892f23895346b898e0f2644e69e5aa4f492a8fdf5601ff07d16
Instruction ID: d087ec24187990148f55d1c2c8d230f4a6b9b3999bccaf919577b0862ee962ad
Opcode Fuzzy Hash: 4bae4a6a99eb3892f23895346b898e0f2644e69e5aa4f492a8fdf5601ff07d16
Instruction Fuzzy Hash: BCA14A71D142699FDB24DF598DC4ADEFAB8BB08304F4086EEE659E3240D7705AC08F61

Function 11115700 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 336COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(11001834,D68DEC44,00000000,?,?), ref: 11115756
_free.LIBCMT ref: 1111586A
LeaveCriticalSection.KERNEL32(?), ref: 11115882
_free.LIBCMT ref: 11115985

Part of subcall function 1115EF45: HeapFree.KERNEL32(00000000,00000000,?,11167B06,00000000,?,1110C98E,?,?,?,?,111415F2,?,?,?), ref: 1115EF5B
Part of subcall function 1115EF45: GetLastError.KERNEL32(00000000,?,11167B06,00000000,?,1110C98E,?,?,?,?,111415F2,?,?,?), ref: 1115EF6D

_memmove.LIBCMT ref: 11115925

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

_free.LIBCMT ref: 1111595D
LeaveCriticalSection.KERNEL32(?), ref: 11115977
LeaveCriticalSection.KERNEL32(?,00000000,00000000,00000000), ref: 11115AD4

Strings

Send AudioFmt, mode=%d, smp/s=%d, bits=%d, xrefs: 11115A58
Replay, xrefs: 11115784
DisableRemoteSounds, xrefs: 11115A28
..\ctl32\Remote.cpp, xrefs: 1111590A
Audio, xrefs: 111158A2, 111158BC, 11115A2D, 11115A9B, 11115AB5
Selected, xrefs: 1111589D, 111158B7, 11115A96, 11115AB0
ReplayAudio, xrefs: 1111577F
idata->audio_nc, xrefs: 1111590F
Error x%x setting audio format, mode x%x, threadcnt=%d, xrefs: 11115946

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave_free$EnterErrorFreeHeapLast__wcstoi64_memmove
String ID: ..\ctl32\Remote.cpp$Audio$DisableRemoteSounds$Error x%x setting audio format, mode x%x, threadcnt=%d$Replay$ReplayAudio$Selected$Send AudioFmt, mode=%d, smp/s=%d, bits=%d$idata->audio_nc
API String ID: 1566931746-2691988374
Opcode ID: 92efa78af1472fe7781d5b7aa5cfd3049f192362687fdd0ef2f321d1b79ee9dd
Instruction ID: e1e47ff18eecd05afc7017615303c18b44b4928c92b25c15aac090fecae6ceb1
Opcode Fuzzy Hash: 92efa78af1472fe7781d5b7aa5cfd3049f192362687fdd0ef2f321d1b79ee9dd
Instruction Fuzzy Hash: C1C1B174A00315AFDB54CFA6C881BAEFBB5BF49304F198429E9569B284EB30F801CB55

Function 110F5780 Relevance: 28.2, APIs: 15, Strings: 1, Instructions: 162windowCOMMON

Download Yara Rule

APIs

SetCursor.USER32(00000000,?,00000000), ref: 110F584B
ShowCursor.USER32(00000000), ref: 110F5858
OpenEventA.KERNEL32(00100000,00000000,NSLockExit), ref: 110F5869
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,?,000000BF), ref: 110F5893
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F58B2
TranslateMessage.USER32(?), ref: 110F58C3
DispatchMessageA.USER32(?), ref: 110F58CC
MsgWaitForMultipleObjects.USER32(00000001,?,00000000,000000FF,000000BF), ref: 110F58E0
CloseHandle.KERNEL32(?), ref: 110F58F3
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F590B
TranslateMessage.USER32(?), ref: 110F591E
DispatchMessageA.USER32(?), ref: 110F5927
GetMessageA.USER32(00000000,00000000,00000000,00000000), ref: 110F593A
ShowCursor.USER32(00000001), ref: 110F5942
SetCursor.USER32(?), ref: 110F594F

Strings

NSLockExit, xrefs: 110F585E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$Cursor$DispatchMultipleObjectsShowTranslateWait$CloseEventHandleOpen
String ID: NSLockExit
API String ID: 1241441011-1578567420
Opcode ID: a5e2f733eb165b9cabdb86a650a77c164e98b15e7ee4ce87d7113b3ccfadda8a
Instruction ID: d0f2308b6254d2eb5dad738dc5256c7059e5bb478a34286a4610975d5487a95c
Opcode Fuzzy Hash: a5e2f733eb165b9cabdb86a650a77c164e98b15e7ee4ce87d7113b3ccfadda8a
Instruction Fuzzy Hash: EC51FB71E0032AABEB11DFA0CC81FEEB7B8AB44714F1045A9F615E7184EB719A41CF91

Function 110035C0 Relevance: 27.2, APIs: 18, Instructions: 171COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000004), ref: 11003601

Part of subcall function 1113EAD0: SetBkColor.GDI32(?,00000000), ref: 1113EAE4
Part of subcall function 1113EAD0: ExtTextOutA.GDI32(?,00000000,00000000,00000002,?,00000000,00000000,00000000), ref: 1113EAF9
Part of subcall function 1113EAD0: SetBkColor.GDI32(?,00000000), ref: 1113EB01

CreateSolidBrush.GDI32(00000000), ref: 11003615
GetStockObject.GDI32(00000007), ref: 11003620
SelectObject.GDI32(?,00000000), ref: 1100362B
SelectObject.GDI32(?,?), ref: 1100363C
GetSysColor.USER32(00000010), ref: 1100364C
GetSysColor.USER32(00000010), ref: 11003663
GetSysColor.USER32(00000014), ref: 1100367A
GetSysColor.USER32(00000014), ref: 11003691
GetSysColor.USER32(00000014), ref: 110036AE
GetSysColor.USER32(00000014), ref: 110036C5
GetSysColor.USER32(00000010), ref: 110036DC
GetSysColor.USER32(00000010), ref: 110036F3
InflateRect.USER32(?,000000FE,000000FE), ref: 11003710
Rectangle.GDI32(?,?,00000001,?,?), ref: 1100372A
SelectObject.GDI32(?,?), ref: 1100373E
SelectObject.GDI32(?,?), ref: 11003748
DeleteObject.GDI32(?), ref: 1100374E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$Object$Select$BrushCreateDeleteInflateRectRectangleSolidStockText
String ID:
API String ID: 3698065672-0
Opcode ID: 644da97bb96dc54d4440f7903720a68b776bb7cdd5a12cd20ae773a14c06a13d
Instruction ID: c25cd1544ae4042dcc2128f2f9484b0b3021c721b0800f8d01ad110ad0b09651
Opcode Fuzzy Hash: 644da97bb96dc54d4440f7903720a68b776bb7cdd5a12cd20ae773a14c06a13d
Instruction Fuzzy Hash: 3B515DB5A00309AFD714DBA5CC85EBFF3BCEB98314F104A18E612A7295D671B9448BB1

Function 11070750 Relevance: 26.6, APIs: 13, Strings: 2, Instructions: 322sleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11087840: IsWindow.USER32(?), ref: 1108785F
Part of subcall function 11087840: IsWindow.USER32(?), ref: 1108786D

EnableWindow.USER32(00000000,00000000), ref: 1107079B
CloseHandle.KERNEL32(00000000,11070600,00000001,00000000), ref: 1107080A
GetTickCount.KERNEL32 ref: 11070863
GetTickCount.KERNEL32 ref: 1107086C
GetTickCount.KERNEL32 ref: 11070885
Sleep.KERNEL32(?,?,?,00000002), ref: 110708C8
Sleep.KERNEL32(0000000A,?,?,00000002), ref: 1107091D
GetTickCount.KERNEL32 ref: 11070A68

Part of subcall function 1110CA00: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 1110CA1E

Strings

gfff, xrefs: 110708A6
, xrefs: 11070A2E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$Window$Sleep$CloseCreateEnableEventHandle
String ID: $gfff
API String ID: 1125177752-257315895
Opcode ID: fed1c93bd5224e5d3d4daebd27104661a4d70c6423ff1ed6c26c64a88284234d
Instruction ID: b6658c133757a0eeae9b35e19b72a3006c38d5418fa8d7bcb27c5c283acd366a
Opcode Fuzzy Hash: fed1c93bd5224e5d3d4daebd27104661a4d70c6423ff1ed6c26c64a88284234d
Instruction Fuzzy Hash: 3BC1BD74B00315AFE724DF24CC81BAEB7B5FF89304F1086A9E586DB384DB74AA418B55

Function 1112E780 Relevance: 26.5, APIs: 8, Strings: 7, Instructions: 241COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1112E82D

Strings

ImageFileUser, xrefs: 1112E90A
ImageFile, xrefs: 1112E7EF
%s%s, xrefs: 1112E827
Client, xrefs: 1112E7F4, 1112E90F
DecompressJPEGToBitmap, xrefs: 1112EA3F
PCIImage.dll, xrefs: 1112EA07
DecompressPNGToBitmap, xrefs: 1112EA21

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s$Client$DecompressJPEGToBitmap$DecompressPNGToBitmap$ImageFile$ImageFileUser$PCIImage.dll
API String ID: 2111968516-1286714176
Opcode ID: 4fef6f4718b686dceda8a2a927ee88775c8d81274e1411b68ea33cfff81f7cdd
Instruction ID: 9ad9e010e4c0f8e46a3580da4ecfb5ad6a3e0e8ecfa8d771c11ae701cf1bd6ac
Opcode Fuzzy Hash: 4fef6f4718b686dceda8a2a927ee88775c8d81274e1411b68ea33cfff81f7cdd
Instruction Fuzzy Hash: E291EB75A41229AFDB21DFA4CDC4FEAF3B4FB44704F6045A5E51597280EB70AA40CFA2

Function 110027F0 Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 219COMMON

Download Yara Rule

APIs

SelectObject.GDI32(?,00000000), ref: 1100282C
ReleaseDC.USER32(?,?), ref: 11002859
MoveToEx.GDI32(?,?,?,00000000), ref: 110028E5
LineTo.GDI32(?,?,?), ref: 11002915
_free.LIBCMT ref: 11002929
SelectObject.GDI32(?,00000000), ref: 11002947
GetDC.USER32(00000000), ref: 11002975
SelectObject.GDI32(00000000,?), ref: 1100298F
SelectObject.GDI32(?,?), ref: 110029A1
MoveToEx.GDI32(?,?,?,00000000), ref: 110029B6
MoveToEx.GDI32(?,?,?,00000000), ref: 110029C7
LineTo.GDI32(?,?,?), ref: 11002A36
MoveToEx.GDI32(?,?,?,00000000), ref: 11002A47

Strings

m_hWnd, xrefs: 11002847, 11002964
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11002842, 1100295F

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MoveObjectSelect$Line$Release_free
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1125916864-2830328467
Opcode ID: b440f74c6c3a07182859df8f842cfe8a9638771b6d0c0e6e50c7c9c979ac75d6
Instruction ID: 99f0a0d87ac1351d67dd4d5bf4ce66e571f70de542276f7143f6d01b0bf1f54f
Opcode Fuzzy Hash: b440f74c6c3a07182859df8f842cfe8a9638771b6d0c0e6e50c7c9c979ac75d6
Instruction Fuzzy Hash: 1091F875A00B45DFD361CF69C888BD7B7E9EB88359F10892DE5AA87314DB30B885CB50

Function 110022B0 Relevance: 26.4, APIs: 11, Strings: 4, Instructions: 162windowCOMMON

Download Yara Rule

APIs

Part of subcall function 11001EF0: FindWindowA.USER32(Progman,00000000), ref: 11001F19
Part of subcall function 11001EF0: GetWindowThreadProcessId.USER32(00000000,?), ref: 11001F27
Part of subcall function 11001EF0: OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 11001F3B
Part of subcall function 11001EF0: GetVersionExA.KERNEL32(?), ref: 11001F54
Part of subcall function 11001EF0: OpenProcessToken.ADVAPI32(00000000,0002000B,00000000), ref: 11001F70
Part of subcall function 11001EF0: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 11001F81
Part of subcall function 11001EF0: CloseHandle.KERNEL32(00000000), ref: 11001F98
Part of subcall function 11001EF0: CloseHandle.KERNEL32(00000000), ref: 11001F9F

CreateCompatibleBitmap.GDI32(?,?,?), ref: 1100231D
CreateCompatibleDC.GDI32(?), ref: 1100232D
SelectObject.GDI32(00000000,?), ref: 11002341
BitBlt.GDI32(?,00000000,00000000,?,?,?,?,?,00CC0020), ref: 11002371

Part of subcall function 11141190: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 111411FD
Part of subcall function 11141190: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,00000000), ref: 1114123E
Part of subcall function 11141190: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114129B

GetSaveFileNameA.COMDLG32(00000058,?,?,?,D68DEC44), ref: 11002414
EnableWindow.USER32(00000000,00000000), ref: 11002488
SelectObject.GDI32(?,?), ref: 11002492
DeleteObject.GDI32(?), ref: 1100249F
DeleteDC.GDI32(?), ref: 110024A6
EnableWindow.USER32(00000000,00000001), ref: 110024CF
RevertToSelf.ADVAPI32(?,?,?,D68DEC44), ref: 110024D1

Strings

m_hWnd, xrefs: 1100246F, 110024BC
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1100246A, 110024B7
X, xrefs: 11002391
BMP, xrefs: 1100240A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$ObjectProcess$CloseCompatibleCreateDeleteEnableFileFolderHandleNameOpenPathSelect$BitmapFindImpersonateLoggedModuleRevertSaveSelfThreadTokenUserVersion
String ID: BMP$X$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3218626338-2539113696
Opcode ID: 650e5fe3d2e9a22dff4796d82409510097bb9d4162f5218dd607dcaf2925300f
Instruction ID: 58be24b61ade7d338f8f8c8d864d89fca22c5648e99ce7fd2dfb7ae814a2fee8
Opcode Fuzzy Hash: 650e5fe3d2e9a22dff4796d82409510097bb9d4162f5218dd607dcaf2925300f
Instruction Fuzzy Hash: FF51A475E007199FE720DF64CC85FDAF7B8EB49708F008598E659A7281D770A940CF51

Function 11018260 Relevance: 26.4, APIs: 7, Strings: 8, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 11141660: GetVersionExA.KERNEL32(111EBB08,?), ref: 11141690
Part of subcall function 11141660: RegOpenKeyExA.ADVAPI32(?,SOFTWARE\Microsoft\Windows NT\CurrentVersion,00000000,00000001,?), ref: 111416CF

Part of subcall function 110181C0: GetSystemMetrics.USER32(0000005E), ref: 110181CF
Part of subcall function 110181C0: GetSystemMetrics.USER32(00002003), ref: 110181E7

FindWindowA.USER32(IPTip_Main_Window,00000000), ref: 110182C1
GetWindowRect.USER32(00000000,?), ref: 110182D9
GetWindowLongA.USER32(00000000,000000F0), ref: 11018311
GetWindowLongA.USER32(00000000,000000EC), ref: 11018318
ExpandEnvironmentStringsA.KERNEL32(00000000,00000000,00000104,?,?,?,00000104), ref: 110183B8
wsprintfA.USER32 ref: 11018408

Part of subcall function 110CE370: _free.LIBCMT ref: 110CE39D

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11018383
SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TabTip.exe, xrefs: 11018351
OpenKbd. No touch kbd, xrefs: 1101845D
open, xrefs: 11018434
c:\program files\common files\microsoft shared\ink\tabtip.exe, xrefs: 110183C5
IPTip_Main_Window, xrefs: 110182BC
IsA(), xrefs: 11018388
OpenKbd keyrect(L=%d, T=%d, R=%d, B=%d), xrefs: 110182FB

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$LongMetricsSystem$EnvironmentExpandFindOpenRectStringsVersion_freewsprintf
String ID: IPTip_Main_Window$IsA()$OpenKbd keyrect(L=%d, T=%d, R=%d, B=%d)$OpenKbd. No touch kbd$SOFTWARE\Microsoft\Windows\CurrentVersion\App Paths\TabTip.exe$c:\program files\common files\microsoft shared\ink\tabtip.exe$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$open
API String ID: 154685902-1061909023
Opcode ID: 46997fad71e3c8c8bc1ca6f78291157ea461b1f94d32f02e887e6de271486604
Instruction ID: 25b304b4de85daf21e1db53fae5ad01bf965219f5178dd5589a30359a5741de6
Opcode Fuzzy Hash: 46997fad71e3c8c8bc1ca6f78291157ea461b1f94d32f02e887e6de271486604
Instruction Fuzzy Hash: 2E51C275E04229ABDB10DB64CC85FDEB774AF05714F1042D9E925672C0EB74AB40CF61

Function 11028060 Relevance: 26.4, APIs: 9, Strings: 6, Instructions: 130librarysynchronizationCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000102), ref: 110280B1

Part of subcall function 11080A00: _strrchr.LIBCMT ref: 11080A0E

wsprintfA.USER32 ref: 110280D4
WaitForSingleObject.KERNEL32(?,000000FF), ref: 11028119
GetExitCodeProcess.KERNEL32(?,?), ref: 1102812D
wsprintfA.USER32 ref: 11028151
CloseHandle.KERNEL32(?), ref: 11028167
CloseHandle.KERNEL32(?), ref: 11028170
LoadLibraryExA.KERNEL32(?,00000000,00000002), ref: 110281D1
GetModuleHandleA.KERNEL32(00000000,00000000), ref: 110281E5

Strings

SetClientResLang called, gPlatform %x, xrefs: 1102807C
Locales\%d\, xrefs: 11028141
", xrefs: 110280AA
pcicl32_res.dll, xrefs: 110281A9
\GetUserLang.exe", xrefs: 110280CE
Setting resource langid=%d, xrefs: 11028191

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$CloseModulewsprintf$CodeExitFileLibraryLoadNameObjectProcessSingleWait_strrchr
String ID: "$Locales\%d\$SetClientResLang called, gPlatform %x$Setting resource langid=%d$\GetUserLang.exe"$pcicl32_res.dll
API String ID: 512045693-1744591295
Opcode ID: 08f42d75f8609797c43ef81733e2361e4869c7c7daba646577695f82441238c0
Instruction ID: 83c46b4a957019a559ed8d95f42355c579e042cd59425fe2f1a4e04427f8c635
Opcode Fuzzy Hash: 08f42d75f8609797c43ef81733e2361e4869c7c7daba646577695f82441238c0
Instruction Fuzzy Hash: 5941C775E00229ABD715CF54DC85FFAF7B8EB44709F5081E6F558A7284DA70A940CBA0

Function 11006180 Relevance: 24.9, APIs: 12, Strings: 2, Instructions: 358COMMON

Download Yara Rule

APIs

ReleaseDC.USER32(00000000,?), ref: 110061F7
InflateRect.USER32(?,?,?), ref: 11006296
SelectObject.GDI32(?,?), ref: 110062BD
SelectObject.GDI32(?,?), ref: 110062CD
MoveToEx.GDI32(?,?,?,00000000), ref: 11006365
LineTo.GDI32(?,?,?), ref: 110063A0
Polygon.GDI32(?,?,00000003), ref: 11006458
SelectObject.GDI32(?,?), ref: 1100646C
SelectObject.GDI32(?,?), ref: 11006476
InflateRect.USER32(?,?,?), ref: 110064B2
GetDC.USER32(00000000), ref: 110064F9

Part of subcall function 11002590: SetROP2.GDI32(?,00000007), ref: 110025A1
Part of subcall function 11002590: SelectObject.GDI32(?,?), ref: 110025B2
Part of subcall function 11002590: MoveToEx.GDI32(?,?,?,00000000), ref: 1100261F
Part of subcall function 11002590: LineTo.GDI32(?,00000000,?), ref: 11002656

__floor_pentium4.LIBCMT ref: 110065B1

Strings

m_hWnd, xrefs: 110061E5, 110064E8
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110061E0, 110064E3

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ObjectSelect$InflateLineMoveRect$PolygonRelease__floor_pentium4
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3432704680-2830328467
Opcode ID: 72f53498bee840adc9f2d5628279e8f2a51e4608a100f6f374a2bb93c2ac6718
Instruction ID: a16f79ed3ec63636837230c351ffb2f4a19155a0327d4f821045793edf1c523c
Opcode Fuzzy Hash: 72f53498bee840adc9f2d5628279e8f2a51e4608a100f6f374a2bb93c2ac6718
Instruction Fuzzy Hash: BCE16E75E00B1ADBCB54DFA9D9949DEFBF8FF48308F108929D46AA7214DB30A851CB50

Function 1102B050 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 220COMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(?), ref: 1102B1B1
GetLastError.KERNEL32(?), ref: 1102B20E
_fgets.LIBCMT ref: 1102B240
_strtok.LIBCMT ref: 1102B268

Part of subcall function 1115F376: __getptd.LIBCMT ref: 1115F394

_fgets.LIBCMT ref: 1102B2A4
_strtok.LIBCMT ref: 1102B2B8

Strings

WARN: No TS lookup file specified!, xrefs: 1102B11D
*LookupFile, xrefs: 1102B0D8
WARN: Could not open TS lookup file: "%s" (%d), user="%s", xrefs: 1102B221
LookupFileUser, xrefs: 1102B17A
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102B101, 1102B1DE
WARN: LoginUser failed (%d) user="%s", xrefs: 1102B1B8
WARN: clientname is empty!, xrefs: 1102B318
IsA(), xrefs: 1102B106, 1102B1E3

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast_fgets_strtok$__getptd
String ID: *LookupFile$IsA()$LookupFileUser$WARN: Could not open TS lookup file: "%s" (%d), user="%s"$WARN: LoginUser failed (%d) user="%s"$WARN: No TS lookup file specified!$WARN: clientname is empty!$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3818798209-1484737611
Opcode ID: 7573179bfc3d03b71a5c47f017d571c14ab627fc8744e60cc9e4e7cdeb3bb5d7
Instruction ID: 3e4cdb6658166b80325583bc8ebf769067624bb76aa8f20cd45f802167754792
Opcode Fuzzy Hash: 7573179bfc3d03b71a5c47f017d571c14ab627fc8744e60cc9e4e7cdeb3bb5d7
Instruction Fuzzy Hash: BD81C575D00A1AABDB10CB94CC80FEEF7B8AF45309F5045D9E919A3241EB75AB84CF91

Function 110CC400 Relevance: 24.7, APIs: 8, Strings: 6, Instructions: 202windowCOMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 110CC4F3
IsWindowVisible.USER32(00000000), ref: 110CC502
SetForegroundWindow.USER32(00000000), ref: 110CC51A
FindResourceExA.KERNEL32(00000000,00000005,?,00000000), ref: 110CC54D
LoadResource.KERNEL32(00000000,00000000), ref: 110CC576
LockResource.KERNEL32(00000000), ref: 110CC59A
DialogBoxIndirectParamA.USER32(00000000,00000000,00000000,110CAB80,111B928C), ref: 110CC5CB
DialogBoxParamA.USER32(00000000,?,00000000,110CAB80,111B928C), ref: 110CC5EA

Strings

hRsrc || !"Unable to find resource", xrefs: 110CC564
m_attached == NULL, xrefs: 110CC41B
..\ctl32\nsmdlg.cpp, xrefs: 110CC416, 110CC4B5, 110CC55F, 110CC587, 110CC5AB
pDlgTemplate || !"Unable to lock resource", xrefs: 110CC5B0
Error. NSMDialog!CreateModal has invisible parent, xrefs: 110CC50C
hGlobal || !"Unable to load resource", xrefs: 110CC58C

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ResourceWindow$DialogParam$FindForegroundIndirectLoadLockVisible
String ID: ..\ctl32\nsmdlg.cpp$Error. NSMDialog!CreateModal has invisible parent$hGlobal || !"Unable to load resource"$hRsrc || !"Unable to find resource"$m_attached == NULL$pDlgTemplate || !"Unable to lock resource"
API String ID: 1492124420-1263985265
Opcode ID: 4096f5eda6105d364b3c0b31534b824cc1fb1b42582e0372c8a0b76f36a3b707
Instruction ID: 1b5fc84a216c21ec3d4810e3fb9b26d76c38828ab470d5f10a9b5134c427e01f
Opcode Fuzzy Hash: 4096f5eda6105d364b3c0b31534b824cc1fb1b42582e0372c8a0b76f36a3b707
Instruction Fuzzy Hash: 96619679E00606ABD701DFA5DC80F9FBBB9AF58758F1081A9E905E7241EB70E540CB91

Function 1100B3A0 Relevance: 24.7, APIs: 6, Strings: 8, Instructions: 190fileCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

EnterCriticalSection.KERNEL32(?,Audio,DisableSounds,00000000,00000000,D68DEC44), ref: 1100B42B
CreateFileA.KERNEL32(\\.\NSAudioFilter,C0000000,00000000,00000000,00000003,40000000,00000000), ref: 1100B448
_calloc.LIBCMT ref: 1100B479
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 1100B49F
LeaveCriticalSection.KERNEL32(?), ref: 1100B4D9

Part of subcall function 1100AC70: EnterCriticalSection.KERNEL32(?,D68DEC44), ref: 1100ACB4
Part of subcall function 1100AC70: LoadLibraryA.KERNEL32(Kernel32.dll), ref: 1100ACD2
Part of subcall function 1100AC70: GetProcAddress.KERNEL32(?,CancelIo), ref: 1100AD1E
Part of subcall function 1100AC70: InterlockedExchange.KERNEL32(?,000000FF), ref: 1100AD65
Part of subcall function 1100AC70: CloseHandle.KERNEL32(00000000), ref: 1100AD6C
Part of subcall function 1100AC70: _free.LIBCMT ref: 1100AD83
Part of subcall function 1100AC70: FreeLibrary.KERNEL32(?), ref: 1100AD9B
Part of subcall function 1100AC70: LeaveCriticalSection.KERNEL32(?), ref: 1100ADA5

LeaveCriticalSection.KERNEL32(?), ref: 1100B4FE

Strings

Vista new pAudioCap=%p, xrefs: 1100B563
Error. Vista AudioCapture GetInstance ret %s, xrefs: 1100B553
Audio, xrefs: 1100B3D7
Error. Vista AddAudioCaptureEventListener ret %s, xrefs: 1100B5AC
\\.\NSAudioFilter, xrefs: 1100B440
InitCaptureSounds NT6, xrefs: 1100B51E
Vista AddAudioCapEvtListener(%p), xrefs: 1100B583
DisableSounds, xrefs: 1100B3D2

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CreateEnterLibrary$AddressCloseEventExchangeFileFreeHandleInterlockedLoadProc__wcstoi64_calloc_free
String ID: Audio$DisableSounds$Error. Vista AudioCapture GetInstance ret %s$Error. Vista AddAudioCaptureEventListener ret %s$InitCaptureSounds NT6$Vista AddAudioCapEvtListener(%p)$Vista new pAudioCap=%p$\\.\NSAudioFilter
API String ID: 2005284756-2362500394
Opcode ID: 74283b47a3cc06ec3d526897e93830d3c1332f6b70a97a72e3a5ceb367b9c95f
Instruction ID: 8cd3870a4469178962bd810a79c67822adc2433c4e055a400c76f51cc8ac3cde
Opcode Fuzzy Hash: 74283b47a3cc06ec3d526897e93830d3c1332f6b70a97a72e3a5ceb367b9c95f
Instruction Fuzzy Hash: 0651D7B9E04646AFE710CF64DC80B9EFBB8FB04369F10467EE91993240EB31765087A1

Function 110043F0 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 160windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 11004424
CreateCompatibleBitmap.GDI32(?,?,?), ref: 11004453
SelectObject.GDI32(00000000,00000000), ref: 11004462
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 11004496
SelectObject.GDI32(00000000,?), ref: 110044A1
SelectObject.GDI32(00000000), ref: 110044BC
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 110044F0
SelectObject.GDI32(00000000,?), ref: 110044FB
DeleteDC.GDI32(00000000), ref: 11004502
DeleteObject.GDI32(00000000), ref: 11004513
InvalidateRect.USER32(00000000,?,00000000), ref: 1100458F
InvalidateRect.USER32(00000000,00000000,00000000), ref: 110045C0

Strings

m_hWnd, xrefs: 11004572, 110045AB
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1100456D, 110045A6

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$CompatibleCreateDeleteInvalidateRect$Bitmap
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2105970896-2830328467
Opcode ID: 5dc94149d304295dda696e910e197e49425026d8c502cc2d08739fb5a529dd81
Instruction ID: cff1d496a7f227d50373fe04c6e6bfd19e625d9831915eb353f71e5ae84f1db2
Opcode Fuzzy Hash: 5dc94149d304295dda696e910e197e49425026d8c502cc2d08739fb5a529dd81
Instruction Fuzzy Hash: 2F513675A00B05AFD725CF68C885BBBF7F9EB88304F51852CE95AD3244DB70B8518B61

Function 110045E0 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 158windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 11004606
CreateCompatibleBitmap.GDI32(?,?,?), ref: 11004635
SelectObject.GDI32(00000000,00000000), ref: 11004644
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 11004678
SelectObject.GDI32(00000000,?), ref: 11004683
SelectObject.GDI32(00000000), ref: 1100469E
BitBlt.GDI32(?,?,?,?,?,00000000,00000000,00000000,00CC0020), ref: 110046D2
SelectObject.GDI32(00000000,?), ref: 110046DD
DeleteDC.GDI32(00000000), ref: 110046E4
DeleteObject.GDI32(00000000), ref: 110046F5
InvalidateRect.USER32(00000000,?,00000000), ref: 1100477D
InvalidateRect.USER32(00000000,00000000,00000000), ref: 110047AE

Strings

m_hWnd, xrefs: 11004760, 11004799
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1100475B, 11004794

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$CompatibleCreateDeleteInvalidateRect$Bitmap
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2105970896-2830328467
Opcode ID: 53e6a45815f4dba874582987ccad2a8847d0659365123b15a2b828a48ad68122
Instruction ID: 2107d2f32b01f02f041f66f9547bdc7ccde668dfd9a4bb3ca17a4f4084e56e13
Opcode Fuzzy Hash: 53e6a45815f4dba874582987ccad2a8847d0659365123b15a2b828a48ad68122
Instruction Fuzzy Hash: 42513675A00B05AFD725CF68C885BBBB7F9EB88304F51852CEA5A93244DB70B851CB61

Function 111035F0 Relevance: 24.7, APIs: 9, Strings: 5, Instructions: 153COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110361E
EnterCriticalSection.KERNEL32(111EB23C), ref: 11103627
GetTickCount.KERNEL32 ref: 1110362D
GetTickCount.KERNEL32 ref: 11103680
LeaveCriticalSection.KERNEL32(111EB23C), ref: 11103689
GetTickCount.KERNEL32 ref: 111036BA
LeaveCriticalSection.KERNEL32(111EB23C), ref: 111036C3
EnterCriticalSection.KERNEL32(111EB23C), ref: 111036EC
LeaveCriticalSection.KERNEL32(111EB23C,00000000,?,00000000), ref: 111037B3

Part of subcall function 110EEEE0: InitializeCriticalSection.KERNEL32(00000038,00000000,00000000,?,00000000,?,11103757,?), ref: 110EEF0B

Strings

info. new psi(%d) = %x, xrefs: 111037A1
Warning. took %d ms to get simap lock, xrefs: 11103639
Warning. simap lock held for %d ms, xrefs: 11103699, 111036D3
e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp, xrefs: 1110366E, 11103723, 11103769
psi, xrefs: 11103673, 11103728, 1110376E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CountTick$Leave$Enter$Initialize
String ID: Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1210\1210f\client32\platnt.cpp$info. new psi(%d) = %x$psi
API String ID: 3599736349-3013461081
Opcode ID: 25e3b2b39aac5b08db64c8f4f46d95aa63595fefd0047c10c73d8bc8817616ab
Instruction ID: 25c79ec1dd9ea3884d35e27ec8d0959279a65a682619e206c7bc08092393d629
Opcode Fuzzy Hash: 25e3b2b39aac5b08db64c8f4f46d95aa63595fefd0047c10c73d8bc8817616ab
Instruction Fuzzy Hash: 8941F2B9F05626AFC701DFE6DC85E9FFFA8BB44258F408535F905E7241EA30690087A6

Function 11157480 Relevance: 24.7, APIs: 10, Strings: 4, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetSubMenu.USER32(00000000,?), ref: 111574D5
GetMenuItemCount.USER32(?), ref: 111574E7
GetMenuItemCount.USER32(?), ref: 111574F1
GetMenuItemInfoA.USER32(?,-00000001,00000001,?), ref: 11157528
DeleteMenu.USER32(?,-00000001,00000400), ref: 11157541
GetMenuItemCount.USER32(?), ref: 11157548
wsprintfA.USER32 ref: 111575DB
IsWindowVisible.USER32(001D9D4E), ref: 111575F1

Strings

C, xrefs: 1115756E
0, xrefs: 11157564
&%d %s, xrefs: 111575CF
0, xrefs: 11157514

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Item$Count$DeleteInfoVisibleWindowwsprintf
String ID: &%d %s$0$0$C
API String ID: 842373234-1709426716
Opcode ID: 6a7e381ed940fc22439dd0c8ee463a75a8c538dab67fc057a44d3dd09ca0aca9
Instruction ID: 8265b4f033c0229ddd731449e078d8dd26dec4f2d7a3cb524678ba8fcb4b293d
Opcode Fuzzy Hash: 6a7e381ed940fc22439dd0c8ee463a75a8c538dab67fc057a44d3dd09ca0aca9
Instruction Fuzzy Hash: 7251E5759006299BDB91CF64CC85BEEF7B8EF45308F508199E51DA7240EB71AA81CFA0

Function 11059310 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 147COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,001D9476,001D8E56,001D9488), ref: 11059384
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 11059396
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 110593A0
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 110593AC
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 110593B6
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 110593C2
CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 110593CC
SetHandleInformation.KERNEL32(00000000,00000001,00000001), ref: 110593D8
ResetEvent.KERNEL32(?), ref: 110593E0
wsprintfA.USER32 ref: 1105940D
CloseHandle.KERNEL32(?), ref: 110594B9

Part of subcall function 1108B780: GetVersionExA.KERNEL32(?,?,?,?,?,?,?,?,?,?,110EAEF9,0000070B), ref: 1108B802
Part of subcall function 1108B780: GetTokenInformation.ADVAPI32(?,00000013(TokenIntegrityLevel),?,00000004,?,?,?,?,?,?,?,?,?,?,110EAEF9,0000070B), ref: 1108B834
Part of subcall function 1108B780: CloseHandle.KERNEL32(00000000), ref: 1108B86C

Strings

CloseHandle_1, xrefs: 110594C6
remcmdstub.exe %u %u %u %u %%COMSPEC%%, xrefs: 11059407
D, xrefs: 1105935D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Handle$EventInformation$Create$Close$ResetTokenVersionwsprintf
String ID: CloseHandle_1$D$remcmdstub.exe %u %u %u %u %%COMSPEC%%
API String ID: 2554110944-1870880251
Opcode ID: f838ed7703d18549c0314ab57baef31b5b5f9ca3cd78fd2a07421276cd7c7973
Instruction ID: 934f531d9c764063a19dada603b08c42f517374d22f3342cb956655e1e9a5649
Opcode Fuzzy Hash: f838ed7703d18549c0314ab57baef31b5b5f9ca3cd78fd2a07421276cd7c7973
Instruction Fuzzy Hash: 4D517871A41318AFEB55DF94CC81FEAB7B8EB48B04F004099F618AB2C4D7B16940CF65

Function 11006630 Relevance: 23.0, APIs: 11, Strings: 2, Instructions: 283COMMON

Download Yara Rule

APIs

ReleaseDC.USER32(00000000,?), ref: 110066C1
SetBkMode.GDI32(?,00000001), ref: 11006728
SelectObject.GDI32(?,?), ref: 1100673F
GetStockObject.GDI32(00000005), ref: 11006757
SelectObject.GDI32(?,?), ref: 1100676F
Rectangle.GDI32(?,?,?,?,?), ref: 110067B5
Ellipse.GDI32(?,?,?,?,?), ref: 110067ED
SelectObject.GDI32(?,?), ref: 110067FB
SelectObject.GDI32(?,?), ref: 11006805
InvalidateRect.USER32(00000000,?,00000001), ref: 1100682B
GetDC.USER32(00000000), ref: 11006865

Strings

m_hWnd, xrefs: 110066AF, 11006817, 11006854
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110066AA, 11006812, 1100684F

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$EllipseInvalidateModeRectRectangleReleaseStock
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3817751823-2830328467
Opcode ID: 516837496d0b5225b39052ca34418c08bdc2b472063b67d655712a20d30fcd1e
Instruction ID: 7e9c128e525440adb891637eb7c8f19b63a720fab920f44c723bd4b10fc1604f
Opcode Fuzzy Hash: 516837496d0b5225b39052ca34418c08bdc2b472063b67d655712a20d30fcd1e
Instruction Fuzzy Hash: 96A13D74A007069FE718CF69CC94AEBB7EAEF88344F20896DE55A83754DB35B940CB50

Function 1102C280 Relevance: 23.0, APIs: 5, Strings: 8, Instructions: 238synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 1110C820: SetEvent.KERNEL32(00000000,00000000,11009122,?,?,?,?,00000000,00000000,00000000,?,Show,Monitor,00000000,00000000), ref: 1110C844

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C2C5
GetTickCount.KERNEL32 ref: 1102C2EA
GetTickCount.KERNEL32 ref: 1102C3E4

Part of subcall function 110CEF20: wvsprintfA.USER32(?,?,1102C381), ref: 110CEF4B

Part of subcall function 110CE370: _free.LIBCMT ref: 110CE39D

WaitForSingleObject.KERNEL32(?,000000FF), ref: 1102C4DC
CloseHandle.KERNEL32(?), ref: 1102C4F8

Strings

_debug, xrefs: 1102C338, 1102C39A
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102C529, 1102C53D, 1102C551, 1102C565
http://geo.netsupportsoftware.com/location/loca.asp, xrefs: 1102C305
?IP=%s, xrefs: 1102C376
GeoIP, xrefs: 1102C333
GetLatLong=%s, took %d ms, xrefs: 1102C401
LatLong, xrefs: 1102C2A8, 1102C395
IsA(), xrefs: 1102C52E, 1102C542, 1102C556, 1102C56A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountObjectSingleTickWait$CloseEventHandle_freewvsprintf
String ID: ?IP=%s$GeoIP$GetLatLong=%s, took %d ms$IsA()$LatLong$_debug$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://geo.netsupportsoftware.com/location/loca.asp
API String ID: 2853339468-1725438197
Opcode ID: 432304aabcc88a739c9ca253f37653b346b3c806c9a1fba9f41334aabaa850f2
Instruction ID: e0faf5db38002502995a4ac2014bca7b1faa9da480a0eaf591dab9f73a5f468a
Opcode Fuzzy Hash: 432304aabcc88a739c9ca253f37653b346b3c806c9a1fba9f41334aabaa850f2
Instruction Fuzzy Hash: 6A819475E0015AABDB04DBE4CD90FEEF7B5AF45708F508698E921672C0DB34BA05CBA1

Function 110273E0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 174windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

LoadLibraryExA.KERNEL32(PCIRES,00000000,00000000), ref: 11027470
LoadIconA.USER32(00000000,00007D0B), ref: 11027485
GetSystemMetrics.USER32(00000032), ref: 1102749E
GetSystemMetrics.USER32(00000031), ref: 110274A3
LoadImageA.USER32(00000000,00007D0B,00000001,00000000), ref: 110274B3
LoadIconA.USER32(00000000,00000491), ref: 110274CB
GetSystemMetrics.USER32(00000032), ref: 110274DA
GetSystemMetrics.USER32(00000031), ref: 110274DF
LoadImageA.USER32(00000000,00000491,00000001,00000000), ref: 110274F0

Strings

AdminUserAcknowledge, xrefs: 1102754B
PCIRES, xrefs: 1102746B
_License, xrefs: 1102741D
product, xrefs: 11027418

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Load$MetricsSystem$IconImage$Library__wcstoi64
String ID: AdminUserAcknowledge$PCIRES$_License$product
API String ID: 1946015-1270847556
Opcode ID: 309821a47a9b39d75ab69a55eb475dce378287c94bbcdb3d8885d7109dfe08fc
Instruction ID: a101e47f5804c7aff7ccc3a0d155066215d2664dfd2fdafdfa34edfb22584a28
Opcode Fuzzy Hash: 309821a47a9b39d75ab69a55eb475dce378287c94bbcdb3d8885d7109dfe08fc
Instruction Fuzzy Hash: 7B51E775E407176BE702CAA48C81F7FF6ADAB54748F504165ED05A7280EBB4E90187A2

Function 11139080 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 144registryCOMMON

Download Yara Rule

APIs

GetClassInfoA.USER32(00000000,NSMDisplayImageClass,00000000), ref: 111390BD
GetStockObject.GDI32(00000005), ref: 111390F9
RegisterClassA.USER32(?), ref: 11139118
GlobalAddAtomA.KERNEL32(NSMDisplayImageClass), ref: 11139141
CreateWindowExA.USER32(00000080,NSMDisplayImageClass,LockImage,80000000,?,?,?,00000000,00000000,00000000,00000000,00000000), ref: 111391D0
ShowWindow.USER32(00000000,00000005), ref: 111391F9
BringWindowToTop.USER32(00000000), ref: 11139200
SetWindowPos.USER32(00000000,000000FF,00000000,00000000,00000000,00000000,00000003), ref: 1113921D
SetForegroundWindow.USER32(00000000), ref: 11139224

Strings

hWnd, xrefs: 111391E6
NSMDisplayImageClass, xrefs: 111390B7, 11139111, 1113913C, 111391C6
UI.CPP, xrefs: 1113912A, 111391E1
LockImage, xrefs: 111391C1

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Class$AtomBringCreateForegroundGlobalInfoObjectRegisterShowStock
String ID: LockImage$NSMDisplayImageClass$UI.CPP$hWnd
API String ID: 4051250341-2435945906
Opcode ID: c039a49725424757a40807a312bac03c50f7b63cf9492e49fdc2bbd9e95d7905
Instruction ID: 02183a8a37612095f886911a2636b3d2f76a9f8c635912267279775cf5585087
Opcode Fuzzy Hash: c039a49725424757a40807a312bac03c50f7b63cf9492e49fdc2bbd9e95d7905
Instruction Fuzzy Hash: BD515CB5E00219AFDB11DFE5DD84BAEFBF5FB48719F20812AE515E7284E63065008B61

Function 110F00F0 Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 121COMMON

Download Yara Rule

APIs

IsValidSid.ADVAPI32(?,?,?,?), ref: 110F00FB
GetSidIdentifierAuthority.ADVAPI32(?,1117CB84), ref: 110F010C
GetSidSubAuthorityCount.ADVAPI32(?), ref: 110F0115
SetLastError.KERNEL32(0000007A), ref: 110F0136

Strings

%lu, xrefs: 110F0192
-%lu, xrefs: 110F0202
S-%lu-, xrefs: 110F0146
0x%02hx%02hx%02hx%02hx%02hx%02hx, xrefs: 110F01D9

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Authority$CountErrorIdentifierLastValid
String ID: %lu$-%lu$0x%02hx%02hx%02hx%02hx%02hx%02hx$S-%lu-
API String ID: 228009767-531523367
Opcode ID: 4e3a795185f23363125ac4c0926bde63620c3db486276ee06a5b131ab824298f
Instruction ID: 69c692ceb76b697f64b770e448d22104cd77ced8a81a416024febc7eee887be1
Opcode Fuzzy Hash: 4e3a795185f23363125ac4c0926bde63620c3db486276ee06a5b131ab824298f
Instruction Fuzzy Hash: 95416B71904162ABC712CF6D9C999EEFFF6AFC6205704C1AAF4D687204F5399504C760

Function 1102305A Relevance: 21.4, APIs: 10, Strings: 2, Instructions: 368windowCOMMON

Download Yara Rule

APIs

Part of subcall function 111572A0: IsIconic.USER32(?), ref: 11157347
Part of subcall function 111572A0: ShowWindow.USER32(?,00000009), ref: 11157357
Part of subcall function 111572A0: BringWindowToTop.USER32(?), ref: 11157361

CheckMenuItem.USER32(00000000,000013EB,-00000009), ref: 1102319D
ShowWindow.USER32(?,00000003), ref: 11023221
LoadMenuA.USER32(00000000,000013A3), ref: 1102334B
GetSubMenu.USER32(00000000,00000000), ref: 11023356
CheckMenuItem.USER32(00000000,000013EB,?), ref: 11023377
GetDlgItem.USER32(?,000013B2), ref: 1102338A
GetWindowRect.USER32(00000000), ref: 11023391
PostMessageA.USER32(?,00000111,?,00000000), ref: 110233F9
DestroyMenu.USER32(00000000), ref: 11023400

Strings

AddToJournal, xrefs: 110232FB
Chat, xrefs: 11023300

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Window$Item$CheckShow$BringDestroyIconicLoadMessagePostRect
String ID: AddToJournal$Chat
API String ID: 693070851-2976406578
Opcode ID: cc65604b4e443d6e146b404b60896ec86fa38265f04f25a65fdce65090e14531
Instruction ID: 4982add7015b932dd0bc0cc7c2dce01c66a22ee0e09c8d3c59eaed155512c9ab
Opcode Fuzzy Hash: cc65604b4e443d6e146b404b60896ec86fa38265f04f25a65fdce65090e14531
Instruction Fuzzy Hash: 8DA1D274F04612ABDB05CF64CC85FAEB3A5AB8C704F904599EA169F2C0DF74B9408BA5

Function 1110C390 Relevance: 21.2, APIs: 6, Strings: 6, Instructions: 190timeCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 1110C494
EnterCriticalSection.KERNEL32(?), ref: 1110C4D3
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000001), ref: 1110C5A3
timeGetTime.WINMM(?,?,?,?,?,?,?,00000000,001D8E64), ref: 1110C5AB
timeGetTime.WINMM ref: 1110C5E6
LeaveCriticalSection.KERNEL32(?), ref: 1110C615

Strings

RecordAudio, xrefs: 1110C3F7
Warning. Writing Audio to replay file without AudioFmt, xrefs: 1110C43A
Creating NC_AUDIOFMT for replay, hash=%d, xrefs: 1110C479
writing audiofmt to file, xrefs: 1110C41B
idata->cplist, xrefs: 1110C589
..\ctl32\RECORD.CPP, xrefs: 1110C584

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSectionTimetime$EnterFileLeavePointer_free
String ID: ..\ctl32\RECORD.CPP$Creating NC_AUDIOFMT for replay, hash=%d$RecordAudio$Warning. Writing Audio to replay file without AudioFmt$idata->cplist$writing audiofmt to file
API String ID: 3404977773-3395386359
Opcode ID: 2170106d0a71b94cb4140baf6b41613aea5e9837f8db7e1af9f54710439a44da
Instruction ID: ff9d3ddeec9fbaf0db39191d6afd7248b34d5202e0a35bbe783862b578ad46cd
Opcode Fuzzy Hash: 2170106d0a71b94cb4140baf6b41613aea5e9837f8db7e1af9f54710439a44da
Instruction Fuzzy Hash: 5971BE74E007069BE721CF64C981BEAF7F4EF89308F14886DE95A97280E675B444CFA1

Function 110F5050 Relevance: 21.1, APIs: 9, Strings: 3, Instructions: 137libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Wtsapi32.dll,D68DEC44,?,?,00000000,?,?,?,?,?,?,?,?,?,?,00000000), ref: 110F507D
GetProcAddress.KERNEL32(00000000,WTSQuerySessionInformationA), ref: 110F50C2
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F5113
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,00000000,111850F0,000000FF,?,11029B50), ref: 110F5128
GetProcAddress.KERNEL32(?,WTSFreeMemory), ref: 110F514D
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,?,?,00000000,111850F0,000000FF), ref: 110F5162
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000000,111850F0,000000FF), ref: 110F5173
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,?,00000000,111850F0,000000FF,?,11029B50), ref: 110F5190
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,00000000,111850F0,000000FF,?,11029B50), ref: 110F51A1

Strings

WTSFreeMemory, xrefs: 110F510D, 110F5147
WTSQuerySessionInformationA, xrefs: 110F50B8
Wtsapi32.dll, xrefs: 110F5078

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastLibraryProc$Free$Load
String ID: WTSFreeMemory$WTSQuerySessionInformationA$Wtsapi32.dll
API String ID: 2188719708-2019804778
Opcode ID: 1031373347f341b86c5d215b3f34edefa2cd47a3134d43d3457464ff13cf572e
Instruction ID: d9a32808c62d3971eb9046f5d439f1378582c9a739821e8de6438fa5c4ec1251
Opcode Fuzzy Hash: 1031373347f341b86c5d215b3f34edefa2cd47a3134d43d3457464ff13cf572e
Instruction Fuzzy Hash: 495136B1E0125AAFCB01CF9AD9C5AAEFBF4FB48305F51856EE519E3200D735A9018F61

Function 11027190 Relevance: 21.1, APIs: 11, Strings: 1, Instructions: 136threadwindowsleepCOMMON

Download Yara Rule

APIs

Part of subcall function 11088160: UnhookWindowsHookEx.USER32(?), ref: 11088183

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000), ref: 110271D4
WaitForMultipleObjects.KERNEL32(00000002,?,00000000,000001F4), ref: 11027243
PostMessageA.USER32(00000000,00000501,00000000,00000000), ref: 11027260
SetEvent.KERNEL32(?), ref: 11027271
Sleep.KERNEL32(00000032), ref: 11027279
PostMessageA.USER32(00000000,00000800,00000000,00000000), ref: 110272AE
GetCurrentThreadId.KERNEL32 ref: 110272DA
GetThreadDesktop.USER32(00000000), ref: 110272E1
SetThreadDesktop.USER32(00000000), ref: 110272EA
CloseDesktop.USER32(00000000), ref: 110272F5
CloseHandle.KERNEL32(?), ref: 11027335

Part of subcall function 1110D640: GetCurrentThreadId.KERNEL32 ref: 1110D6D6
Part of subcall function 1110D640: InitializeCriticalSection.KERNEL32(-00000010,?,000000FF,?,1100C944,00000001,?), ref: 1110D6E9
Part of subcall function 1110D640: InitializeCriticalSection.KERNEL32(111EB518,?,000000FF,?,1100C944,00000001,?), ref: 1110D6F8
Part of subcall function 1110D640: EnterCriticalSection.KERNEL32(111EB518,?,000000FF,?,1100C944), ref: 1110D70C
Part of subcall function 1110D640: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,?,1100C944), ref: 1110D732

Strings

Async, xrefs: 110271B8

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Thread$CriticalDesktopEventSection$CloseCreateCurrentInitializeMessagePost$EnterHandleHookMultipleObjectsSleepUnhookWaitWindows
String ID: Async
API String ID: 3710840599-2933828738
Opcode ID: e969f5dbd180e6c87efbfd1b4baff7fc8b4e81a16fc1d0b285ea0a5ae2cb110b
Instruction ID: 7fc1292e02a128963bf030f596ef928a45cfb08f301e7d6a3b78982e09b227fa
Opcode Fuzzy Hash: e969f5dbd180e6c87efbfd1b4baff7fc8b4e81a16fc1d0b285ea0a5ae2cb110b
Instruction Fuzzy Hash: FD41B571A01612ABE702DFE4CC85B7DFBA4BB15718F504179FA25D72C4EB70A504CBA1

Function 11130090 Relevance: 21.1, APIs: 5, Strings: 7, Instructions: 107COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11130100
GetTickCount.KERNEL32 ref: 11130131
SHGetFolderPathA.SHFOLDER(00000000,0000002B,00000000,00000000,?), ref: 11130144
GetTickCount.KERNEL32 ref: 1113014C

Strings

runplugin.exe, xrefs: 111300DE
%s%s, xrefs: 111300FA, 1113019E
schplayer.exe, xrefs: 11130188
Software\NSL, xrefs: 11130174
Warning. SHGetFolderPath took %d ms, xrefs: 11130156
CommonPath, xrefs: 1113016F
HasStudentComponents=%d, xrefs: 111301C7

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$FolderPathwsprintf
String ID: %s%s$CommonPath$HasStudentComponents=%d$Software\NSL$Warning. SHGetFolderPath took %d ms$runplugin.exe$schplayer.exe
API String ID: 1170620360-4157686185
Opcode ID: 34a3ff033ec8ca8d4e063d59840cb8e4d785090d69b102d517081d841d2dc2d2
Instruction ID: d7dfaca54a7504ad64f5682d299363b5700fa1850ef802551658640b5d670ced
Opcode Fuzzy Hash: 34a3ff033ec8ca8d4e063d59840cb8e4d785090d69b102d517081d841d2dc2d2
Instruction Fuzzy Hash: AC318B79F022256BD701DBA49C80FAEF7E8AB8031DF104075E904A7245EA70F6008BB2

Function 1100D5E0 Relevance: 19.6, APIs: 1, Strings: 12, Instructions: 50COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1100D651

Strings

Unknown error %d, xrefs: 1100D647
AlreadyStopped, xrefs: 1100D61C
DllInitFailed, xrefs: 1100D607
StillInstances, xrefs: 1100D63F
BadParam, xrefs: 1100D631
NotFound, xrefs: 1100D62A
CannotGetFunc, xrefs: 1100D60E
NoCapClients, xrefs: 1100D623
AlreadyStarted, xrefs: 1100D615
RequiresVista, xrefs: 1100D5F9
Exception, xrefs: 1100D638, 1100D646
CannotLoadDll, xrefs: 1100D600

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: AlreadyStarted$AlreadyStopped$BadParam$CannotGetFunc$CannotLoadDll$DllInitFailed$Exception$NoCapClients$NotFound$RequiresVista$StillInstances$Unknown error %d
API String ID: 2111968516-2092292787
Opcode ID: 7ac1e4dcb7868550f1734a0c79dd56a4a6c36cc41531c5daa9bb00b3bc3a9735
Instruction ID: 141f0bff9d4104465faaf3111e892713865f7fc44b795d2515e7441fccb3aae5
Opcode Fuzzy Hash: 7ac1e4dcb7868550f1734a0c79dd56a4a6c36cc41531c5daa9bb00b3bc3a9735
Instruction Fuzzy Hash: 33F05A3A68050C67AB0186EC78404BEB38C628447D3C8809AF4BCEBE20E912DDE0A1D5

Function 11008200 Relevance: 19.5, APIs: 9, Strings: 2, Instructions: 264windowCOMMON

Download Yara Rule

APIs

ReleaseDC.USER32(?,?), ref: 11008255
_free.LIBCMT ref: 11008383
SelectObject.GDI32(?,?), ref: 110083A5
DeleteDC.GDI32(?), ref: 110083B2
DeleteObject.GDI32(?), ref: 110083BF
GetDC.USER32(00000000), ref: 110083ED
CreateCompatibleDC.GDI32(00000000), ref: 110083FA
CreateCompatibleBitmap.GDI32(?,00000004,00000010), ref: 11008411
SelectObject.GDI32(?,00000000), ref: 11008425

Strings

m_hWnd, xrefs: 11008243, 110083DC
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1100823E, 110083D7

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$BitmapRelease_free
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3576303165-2830328467
Opcode ID: 076b9647942e83a8aa57d8b4be3dd06244576eab8e5e2f97f5bccf9f4a1129e3
Instruction ID: 35dfa2e5c44d61af19170d68f6ebf476c1a4c552260c3f46d80fb314baf8fd0f
Opcode Fuzzy Hash: 076b9647942e83a8aa57d8b4be3dd06244576eab8e5e2f97f5bccf9f4a1129e3
Instruction Fuzzy Hash: F2B1E5B5A00B019FD365CF29C984AD7B7E9FB88359F10892EE5AE87351DB30B941CB50

Function 110164F0 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 154windowtimethreadCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 1101652C
IsWindowVisible.USER32(?), ref: 11016539
GetWindow.USER32(?,00000004), ref: 11016546
IsWindowVisible.USER32(00000000), ref: 11016551
GetClassNameA.USER32(?,?,00000020), ref: 11016566
SendMessageTimeoutA.USER32(?,0000000D,000000C8,?,00000002,00000064,?), ref: 110165CF
GetWindowThreadProcessId.USER32(?,?), ref: 110165F4
DeleteObject.GDI32(00000000), ref: 1101664F

Strings

NSSWControl32, xrefs: 1101658D
Progman, xrefs: 1101656F
NSMWControl32, xrefs: 11016594, 11016599

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Visible$ClassDeleteMessageNameObjectProcessRectSendThreadTimeout
String ID: NSMWControl32$NSSWControl32$Progman
API String ID: 3572104470-975155618
Opcode ID: 806d842201627a61e6132d619239e543b52a3dca8d078473789719a9fbbdcad1
Instruction ID: 6ddddd1bd87e85a7595c1b56a31a018b07c786c56300c6d2f33462f49393d024
Opcode Fuzzy Hash: 806d842201627a61e6132d619239e543b52a3dca8d078473789719a9fbbdcad1
Instruction Fuzzy Hash: EF516175D00229AFDB54CF64DC84BEDB7B8AF49304F0085E9E919E7244EB74AA84CF91

Function 1105D000 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 130windowregistryCOMMON

Download Yara Rule

APIs

RegisterClassA.USER32(111E82EC), ref: 1105D062
CreateWindowExA.USER32(00000000,NSMCobrProxy,11190210,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000,00000000), ref: 1105D0A3
SetPropA.USER32(?,NSMCobrProxy,00000000), ref: 1105D12D
GetMessageA.USER32(00000000,?,00000000,00000000), ref: 1105D150
TranslateMessage.USER32(?), ref: 1105D166
DispatchMessageA.USER32(?), ref: 1105D16C

Strings

NSMCobrProxy, xrefs: 1105D058, 1105D09C, 1105D127
m_hAppWin, xrefs: 1105D0BA
CobrowseProxy.cpp, xrefs: 1105D074, 1105D0B5
CobrowseProxy::RunCobrowse, xrefs: 1105D02A
_bOK, xrefs: 1105D079

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$ClassCreateDispatchPropRegisterTranslateWindow
String ID: CobrowseProxy.cpp$CobrowseProxy::RunCobrowse$NSMCobrProxy$_bOK$m_hAppWin
API String ID: 3820042830-1383313024
Opcode ID: 2dae983c68088e69c9016106b10f5cdbde4df709d598f16fa4ff660b5f3b7c91
Instruction ID: 323a87a38ea77b2a772ea8b626bde05ae26f52ce7edbb5e7ea4ea7b0faa545d9
Opcode Fuzzy Hash: 2dae983c68088e69c9016106b10f5cdbde4df709d598f16fa4ff660b5f3b7c91
Instruction Fuzzy Hash: 2741F675E01306ABD761DF95CC80F9BFBE4AB44718F108529F91697280EB30E441CB65

Function 111402C0 Relevance: 19.3, APIs: 9, Strings: 2, Instructions: 79libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 111402E6
GetProcAddress.KERNEL32(00000000), ref: 111402ED
GetCurrentProcessId.KERNEL32(00000000), ref: 11140303
GetCurrentProcessId.KERNEL32 ref: 11140321
OpenProcess.KERNEL32(00000400,00000000,00000000), ref: 1114032B
OpenProcessToken.ADVAPI32(00000000,00000008,00000000), ref: 1114033E
GetTokenInformation.ADVAPI32(00000000,0000000C(TokenIntegrityLevel),111E54A4,00000004,?), ref: 1114035D
CloseHandle.KERNEL32(00000000), ref: 11140384
CloseHandle.KERNEL32(00000000), ref: 1114038B

Strings

kernel32.dll, xrefs: 111402DA
ProcessIdToSessionId, xrefs: 111402D5

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Process$Handle$CloseCurrentOpenToken$AddressInformationModuleProc
String ID: ProcessIdToSessionId$kernel32.dll
API String ID: 2536908267-3889420803
Opcode ID: ca18dbb55407b2008b4e66abc8900f72b386269f76fc7afc1084f69c89091846
Instruction ID: 9cd20591f84cc3dcaf94c91a980a753fdd4d0a9845dd6df4c8ce9e31dc3d3afe
Opcode Fuzzy Hash: ca18dbb55407b2008b4e66abc8900f72b386269f76fc7afc1084f69c89091846
Instruction Fuzzy Hash: E321A135A0521AAFE711DEAACD48F9FFFBCEB44B15F104165E914E7244EB30D9008B61

Function 1115A710 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 57COMMON

Download Yara Rule

APIs

GlobalAddAtomA.KERNEL32(NSMWndClass), ref: 1115A738
GetLastError.KERNEL32 ref: 1115A745
wsprintfA.USER32 ref: 1115A758
GlobalAddAtomA.KERNEL32(NSMReflect), ref: 1115A79C
GlobalAddAtomA.KERNEL32(NSMDropTarget), ref: 1115A7A9

Strings

NSMWndClass, xrefs: 1115A730
GlobalAddAtom failed, e=%d, xrefs: 1115A752
..\ctl32\wndclass.cpp, xrefs: 1115A769, 1115A785
NSMReflect, xrefs: 1115A797
m_aProp, xrefs: 1115A78A
NSMDropTarget, xrefs: 1115A79E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AtomGlobal$ErrorLastwsprintf
String ID: ..\ctl32\wndclass.cpp$GlobalAddAtom failed, e=%d$NSMDropTarget$NSMReflect$NSMWndClass$m_aProp
API String ID: 3215550980-1728070458
Opcode ID: 185a79f470edde923437314096c9e7087464128d7ddf2938ccdae136574180a6
Instruction ID: 42b7c5198d372314a98269bb1119a828b07af46dd1f45bdd77212d9e136f0bed
Opcode Fuzzy Hash: 185a79f470edde923437314096c9e7087464128d7ddf2938ccdae136574180a6
Instruction Fuzzy Hash: DE112375A01318AFC721EFEA9CC09AAF7B4FF41308F40856EE56A53544EB716540CFAA

Function 110CD5B0 Relevance: 18.1, APIs: 12, Instructions: 113windowCOMMON

Download Yara Rule

APIs

GetStretchBltMode.GDI32(?,?,?,1101CC51,?,00000002,?), ref: 110CD5E8
SetStretchBltMode.GDI32(?,00000004), ref: 110CD5F6
GetDC.USER32(00000000), ref: 110CD5FE
CreateCompatibleDC.GDI32(00000000), ref: 110CD607
CreateCompatibleBitmap.GDI32(00000000,00000280,000001E0), ref: 110CD61A
SelectObject.GDI32(00000000,00000000), ref: 110CD625
StretchBlt.GDI32(?,?,?,00000000,?,00000000,00000000,00000000,00000280,000001E0,00CC0020), ref: 110CD68C
SelectObject.GDI32(00000000,1101CC51), ref: 110CD697
DeleteObject.GDI32(?), ref: 110CD6A1
DeleteDC.GDI32(00000000), ref: 110CD6A8
ReleaseDC.USER32(00000000,00000000), ref: 110CD6B1
SetStretchBltMode.GDI32(?,?), ref: 110CD6BE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Stretch$ModeObject$CompatibleCreateDeleteSelect$BitmapRelease
String ID:
API String ID: 3869104054-0
Opcode ID: 4cd5c15a1307939a7bc44611b11280addb4b9eea335058283b3b6782dfa3e116
Instruction ID: c0da6a2cf107fd78aef0e1cab46b479419bb504b99182884ef6df3bbcda64d0c
Opcode Fuzzy Hash: 4cd5c15a1307939a7bc44611b11280addb4b9eea335058283b3b6782dfa3e116
Instruction Fuzzy Hash: 8C3119B5600215AFD700DFA8CC89FAEB7B9EF8D704F208158FA15DB294D670AD01CBA1

Function 11022530 Relevance: 18.0, APIs: 1, Strings: 9, Instructions: 473COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110227F3

Strings

RDH: CHATEX_WB_SHOW, xrefs: 11022B19
toastImageAndText.png, xrefs: 1102288B
toastChat.png, xrefs: 110228D8
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102265D, 11022694, 110226CE
RDH::CHATEX_WB_UPDATE received, xrefs: 11022AF1
pcicl32.dll, xrefs: 11022848
RDH: CHATEX_WB_HIDE, xrefs: 11022B3E
IsA(), xrefs: 11022662, 11022699, 110226D3
CHATEX Whiteboard - flags %x, submode %x, xrefs: 11022AD3

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileModuleName
String ID: CHATEX Whiteboard - flags %x, submode %x$IsA()$RDH: CHATEX_WB_HIDE$RDH: CHATEX_WB_SHOW$RDH::CHATEX_WB_UPDATE received$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$pcicl32.dll$toastChat.png$toastImageAndText.png
API String ID: 514040917-2292972993
Opcode ID: 4f7d70e866d7af7a30f828c9981f922ba0eb4a8f2b124ab1a5c67f9031985aa1
Instruction ID: f3f64a7268d9e1e5d0f0c548873aa61f04e410ca8b59ddc098f1957c07bf6fab
Opcode Fuzzy Hash: 4f7d70e866d7af7a30f828c9981f922ba0eb4a8f2b124ab1a5c67f9031985aa1
Instruction Fuzzy Hash: 8002A038E042199FDB15CB94CC98FEEB7B5BF48308F5081D9E4195B291EB70AE85CB61

Function 1111D530 Relevance: 17.7, APIs: 9, Strings: 1, Instructions: 211timeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 1111D55B
SetWindowOrgEx.GDI32(?,?,?,00000000), ref: 1111D652
GetSystemMetrics.USER32(00000000), ref: 1111D6E7
GetSystemMetrics.USER32(00000001), ref: 1111D6EE

Part of subcall function 1110C390: EnterCriticalSection.KERNEL32(?), ref: 1110C4D3

GetClientRect.USER32(00000000,?), ref: 1111D757
MapWindowPoints.USER32(00000000,00000000,?,00000002), ref: 1111D769
GetCursorPos.USER32(?), ref: 1111D773
PtInRect.USER32(?,?,?), ref: 1111D785
SetCursorPos.USER32(?,?,?,?,?,?,?,?,?,?,?), ref: 1111D797

Strings

DoWSlave, szChg=%d, w=%d, h=%d, xrefs: 1111D7AB

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CursorMetricsRectSystemWindow$ClientCriticalEnterPointsSectionTimetime
String ID: DoWSlave, szChg=%d, w=%d, h=%d
API String ID: 299883369-4205893
Opcode ID: 2878f3d1fde968544ba7fba1944925677b9ae6a56e05a81e44a717b321ffc0db
Instruction ID: 89919cc83dbe9d0ba3f806106df774eb0b45ab4159e82789d57dd116e04cca69
Opcode Fuzzy Hash: 2878f3d1fde968544ba7fba1944925677b9ae6a56e05a81e44a717b321ffc0db
Instruction Fuzzy Hash: 32817DB4900B159FDB14DF75C884BABF7F5EF88309F50892EE85A9B244E734A840CB61

Function 11032580 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 183clipboardCOMMON

Download Yara Rule

APIs

CountClipboardFormats.USER32 ref: 110325C1
EnumClipboardFormats.USER32(00000000), ref: 11032626
GetLastError.KERNEL32 ref: 110326EF
GetLastError.KERNEL32(00000000), ref: 110326F2
IsClipboardFormatAvailable.USER32(00000008), ref: 11032755

Strings

ppFormats, xrefs: 110325B0
..\ctl32\clipbrd.cpp, xrefs: 110325AB
Error enumclip, e=%d, x%x, xrefs: 110326F5

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Clipboard$ErrorFormatsLast$AvailableCountEnumFormat
String ID: ..\ctl32\clipbrd.cpp$Error enumclip, e=%d, x%x$ppFormats
API String ID: 3345160754-597690070
Opcode ID: b41541f4c05eb5c8ad87aa46d3695884518a61f669694eb7fd1890ae6fd28f4d
Instruction ID: 0a3e1b23f1dda18ccdc406fd82053a1117886958b129cecb23e2b78ba1a2fe40
Opcode Fuzzy Hash: b41541f4c05eb5c8ad87aa46d3695884518a61f669694eb7fd1890ae6fd28f4d
Instruction Fuzzy Hash: A351AF74E1022A8FDB11DFA4C88479DFBF4FF89309F2081AAD959A7241EB719944CF91

Function 11071660 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 175sleeptimeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(00000000,?,?,?,111C7B7C), ref: 110716F8
Sleep.KERNEL32(00000064,?,?,111C7B7C), ref: 11071742
DeleteCriticalSection.KERNEL32(?,?,?,111C7B7C), ref: 110717D0
DeleteCriticalSection.KERNEL32(?,?,?,111C7B7C), ref: 110717D6
DeleteCriticalSection.KERNEL32(?,?,?,111C7B7C), ref: 110717DC
DeleteCriticalSection.KERNEL32(?,?,?,111C7B7C), ref: 110717E2
DeleteCriticalSection.KERNEL32(?,?,?,111C7B7C), ref: 110717E8
DeleteCriticalSection.KERNEL32(?,?,?,111C7B7C), ref: 110717EE

Part of subcall function 1110D1E0: DeleteCriticalSection.KERNEL32(?,D68DEC44,?,?,?,?,00000000,1117E388,000000FF,?,1100CAFD), ref: 1110D22A
Part of subcall function 1110D1E0: EnterCriticalSection.KERNEL32 ref: 1110D275
Part of subcall function 1110D1E0: SetEvent.KERNEL32(?), ref: 1110D29E
Part of subcall function 1110D1E0: CloseHandle.KERNEL32(?), ref: 1110D2D2
Part of subcall function 1110D1E0: WaitForSingleObject.KERNEL32(?,000000FF), ref: 1110D2E0
Part of subcall function 1110D1E0: CloseHandle.KERNEL32(?), ref: 1110D2ED

Strings

..\ctl32\Connect.cpp, xrefs: 11071765
idata->dialup == NULL, xrefs: 1107176A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Delete$CloseHandle$EnterEventKillObjectSingleSleepTimerWait
String ID: ..\ctl32\Connect.cpp$idata->dialup == NULL
API String ID: 161544936-3355235989
Opcode ID: 44352112c6202d709b7626748c79244f955a6993421b9d07f23978288481cf2e
Instruction ID: c03c3e432656aba7aaa7a8a698493163416a64524ac750959d463a8e6b434d28
Opcode Fuzzy Hash: 44352112c6202d709b7626748c79244f955a6993421b9d07f23978288481cf2e
Instruction Fuzzy Hash: 1951D379901605ABDB14DFA4CC80BAEF7F9BF85308F01451DE96A97284DB74BA04CBA1

Function 11052130 Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 156COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(111E7EC0,D68DEC44,408B018B,?,05685620,?,00000000,1117CFCE), ref: 11052164
GetTickCount.KERNEL32 ref: 110521C6
std::_Xinvalid_argument.LIBCPMT ref: 110522AD
std::exception::exception.LIBCMT ref: 110522BC
__CxxThrowException@8.LIBCMT ref: 110522D1
LeaveCriticalSection.KERNEL32(111E7EC0,?,111C7B7C,?,list<T> too long,?,FFFFFFFF,?,?), ref: 110522DB
LeaveCriticalSection.KERNEL32(111E7EC0,?,FFFFFFFF,?,?,?,00000000,1117CFCE), ref: 11052313

Strings

list<T> too long, xrefs: 110522A8
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110521E1
IsA(), xrefs: 110521E6

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$CountEnterException@8ThrowTickXinvalid_argumentstd::_std::exception::exception
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$list<T> too long
API String ID: 1008553331-1197860701
Opcode ID: e9c1a22a894e39e32b0c6e9390b8b37668e275ae573feb8738bc860e4bc096ab
Instruction ID: 249d46c279069acd25932a21d06ff98220962c794e2cb1794d39aa7c9769548a
Opcode Fuzzy Hash: e9c1a22a894e39e32b0c6e9390b8b37668e275ae573feb8738bc860e4bc096ab
Instruction Fuzzy Hash: BE517E79A01656EFDB45CFE4D984BAEFBB4FF09308F008169E916A7344D731A900CBA1

Function 110FD520 Relevance: 17.7, APIs: 4, Strings: 6, Instructions: 155threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

GetLastError.KERNEL32(Client,00000000,00000001,00000000), ref: 110FD626
GetCurrentThreadId.KERNEL32 ref: 110FD65C
GetCurrentThreadId.KERNEL32 ref: 110FD66A

Strings

Client, xrefs: 110FD569, 110FD5F4
Event. %s, xrefs: 110FD686
*Log_%d, xrefs: 110FD54C
PLATFORM.CPP, xrefs: 110FD639
nstrings <= 4, xrefs: 110FD63E
LogWhileConnected, xrefs: 110FD5EF

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentThread$ErrorLast__wcstoi64
String ID: *Log_%d$Client$Event. %s$LogWhileConnected$PLATFORM.CPP$nstrings <= 4
API String ID: 2021241812-3565238984
Opcode ID: 3b2a5fad7724ebc1a05b9848722b6f6ef97613db97e2fb66251e4383ff5b38ea
Instruction ID: 008ec68671a546dd98e2923cff198553275dd029ae85a6940d6e93c0042ef799
Opcode Fuzzy Hash: 3b2a5fad7724ebc1a05b9848722b6f6ef97613db97e2fb66251e4383ff5b38ea
Instruction Fuzzy Hash: F4512875E00117ABE711DFA5CC86FBEBBA4EF88718F104139F92997280E674A900C7A1

Function 1103D380 Relevance: 17.6, APIs: 1, Strings: 9, Instructions: 146COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 1103D3D3

Strings

SETUSBMASSSTORAGEACCESS, xrefs: 1103D3E3
SETOPTICALDRIVEACCESS, xrefs: 1103D414
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1103D47F
RESUMEPRINTINGPRINTER=*FILETYPES=, xrefs: 1103D462
BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1, xrefs: 1103D45B
SETOPTICALDRIVEACCESSACCESSMODES=%u, xrefs: 1103D42F
BLOCKPRINTING, xrefs: 1103D43D
IsA(), xrefs: 1103D484
SETUSBMASSSTORAGEACCESSACCESSMODES=%u, xrefs: 1103D406

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: BLOCKPRINTING$BLOCKPRINTINGPRINTER=*FILETYPES=BLOCK=1$IsA()$RESUMEPRINTINGPRINTER=*FILETYPES=$SETOPTICALDRIVEACCESS$SETOPTICALDRIVEACCESSACCESSMODES=%u$SETUSBMASSSTORAGEACCESS$SETUSBMASSSTORAGEACCESSACCESSMODES=%u$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 4104443479-1830555902
Opcode ID: 1c604597c6dc7b7e80bf5c3ef5eb313e7adf07e3cbf69874e4539105635ba77d
Instruction ID: 3e94f767143cb2f71d54622c5b3686182f94ae942a7077cb41db0d5d6bd0f4df
Opcode Fuzzy Hash: 1c604597c6dc7b7e80bf5c3ef5eb313e7adf07e3cbf69874e4539105635ba77d
Instruction Fuzzy Hash: CE41E77590025AAFCB01DF64CC80ADEB7F8EF85319F448568EC55A7241EA35F908CBA0

Function 11105040 Relevance: 17.6, APIs: 5, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1110506E
EnterCriticalSection.KERNEL32(111EB23C), ref: 11105081
GetTickCount.KERNEL32 ref: 11105087
GetTickCount.KERNEL32 ref: 111051D3
LeaveCriticalSection.KERNEL32(111EB23C), ref: 111051DC

Strings

Warning. took %d ms to get simap lock, xrefs: 11105096
Warning. simap lock held for %d ms, xrefs: 111051EC
IsA(), xrefs: 11105123, 1110514F
TerminateVistaUI, xrefs: 1110515F
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 1110511E, 1110514A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$CriticalSection$EnterLeave
String ID: IsA()$TerminateVistaUI$Warning. simap lock held for %d ms$Warning. took %d ms to get simap lock$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 956672424-3883062340
Opcode ID: f52b191513a344c6b306737cbfd0b33af6f36d07ff5420927bd6ecd01dac171e
Instruction ID: 6f29ee8de3f685b90cbc6a9b538b06333f8366e0852f8200a70c283388af3797
Opcode Fuzzy Hash: f52b191513a344c6b306737cbfd0b33af6f36d07ff5420927bd6ecd01dac171e
Instruction Fuzzy Hash: 8051CF39E0025AAFDB01DFA4DD84B9EFBB4AF45308F508168E825A7251D731AD04CBA1

Function 11079790 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,1107D882), ref: 110797D0
BeginDeferWindowPos.USER32(00000008), ref: 110797E3
GetTopWindow.USER32(?), ref: 110797F7
GetClassNameA.USER32(00000000,00000000,00000020), ref: 11079817
GetWindowLongA.USER32(00000000,00000000), ref: 1107984C
GetWindow.USER32(00000000,00000002), ref: 11079860
CopyRect.USER32(00000002,1107D882), ref: 1107987F
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000017), ref: 110798C7
EndDeferWindowPos.USER32(00000000), ref: 110798D5

Strings

NSMCoolbar, xrefs: 11079819

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$DeferRect$BeginClassClientCopyLongName
String ID: NSMCoolbar
API String ID: 1900817757-4124301854
Opcode ID: 52a851374e84ef384f2e3d5da4f628937bb8759183212c405371fdc2620b5442
Instruction ID: d7f9ef35ea8ff9cc3b5353f8f96db46f5acdb9e8918179d1e20d962ffde98f38
Opcode Fuzzy Hash: 52a851374e84ef384f2e3d5da4f628937bb8759183212c405371fdc2620b5442
Instruction Fuzzy Hash: 93417075E0021AEBDB41CFA4D8C4BADFBF9FF49324F1081A9E955A7241E731A804CB65

Function 1110D640 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 132threadCOMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 1110D6AA
__CxxThrowException@8.LIBCMT ref: 1110D6BF
GetCurrentThreadId.KERNEL32 ref: 1110D6D6
InitializeCriticalSection.KERNEL32(-00000010,?,000000FF,?,1100C944,00000001,?), ref: 1110D6E9
InitializeCriticalSection.KERNEL32(111EB518,?,000000FF,?,1100C944,00000001,?), ref: 1110D6F8
EnterCriticalSection.KERNEL32(111EB518,?,000000FF,?,1100C944), ref: 1110D70C
CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,?,1100C944), ref: 1110D732
LeaveCriticalSection.KERNEL32(111EB518,?,000000FF,?,1100C944), ref: 1110D7BF

Strings

..\ctl32\Refcount.cpp, xrefs: 1110D746
QueueThreadEvent, xrefs: 1110D74B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Initialize$CreateCurrentEnterEventException@8LeaveThreadThrowstd::exception::exception
String ID: ..\ctl32\Refcount.cpp$QueueThreadEvent
API String ID: 3533989917-1024648535
Opcode ID: cb25374c0de5c291375c348cdbaeed71137f5b0179ba5cd9e40ca6335a9e0c2e
Instruction ID: 63ebb359f489ae645d86a8697e44fe9812c80b32725736a6d22a3b26a7f04e5e
Opcode Fuzzy Hash: cb25374c0de5c291375c348cdbaeed71137f5b0179ba5cd9e40ca6335a9e0c2e
Instruction Fuzzy Hash: E841C3B4E01615AFDB12DFA9CC84B6EFBE4FB84708F50857AE415D3244E77065008FA1

Function 1111C7D0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 63windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32 ref: 1111C7F7
CreatePen.GDI32(00000000,00000001,00C0C0C0), ref: 1111C80C
SetBkMode.GDI32(?,00000002), ref: 1111C821
SetBkColor.GDI32(?,00000000), ref: 1111C830
SetTextColor.GDI32(?,00FFFFFF), ref: 1111C842

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

SetStretchBltMode.GDI32(?,?), ref: 1111C871

Part of subcall function 1110FDD0: GetStockObject.GDI32(00000003), ref: 1110FE07
Part of subcall function 1110FDD0: FillRect.USER32(?,?,00000000), ref: 1110FE24
Part of subcall function 1110FDD0: FillRect.USER32(?,?,00000000), ref: 1110FE32
Part of subcall function 1110FDD0: SetROP2.GDI32(?,00000007), ref: 1110FE5E
Part of subcall function 1110FDD0: SetBkMode.GDI32(?,?), ref: 1110FE6A
Part of subcall function 1110FDD0: SetBkColor.GDI32(?,?), ref: 1110FE75
Part of subcall function 1110FDD0: SetTextColor.GDI32(?,?), ref: 1110FE80
Part of subcall function 1110FDD0: SetTextJustification.GDI32(?,?,?), ref: 1110FE91
Part of subcall function 1110FDD0: SetTextCharacterExtra.GDI32(?,?), ref: 1110FE9D

SetTextJustification.GDI32(?,00000000,00000000), ref: 1111C887
SetTextCharacterExtra.GDI32(?,00000000), ref: 1111C896

Strings

ScaleToFitMode, xrefs: 1111C84F
View, xrefs: 1111C854

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$Color$Mode$CharacterExtraFillJustificationRect$CreateObjectPaletteSelectStockStretch__wcstoi64
String ID: ScaleToFitMode$View
API String ID: 1232059938-1738379822
Opcode ID: 145f0dc581eb54d48936fad1517c7ca1c684cfcf59110d64dc2045c9b492cb24
Instruction ID: 75d5dcf95ddea189a7f8df9b434ee8d7356f289bd786e89179907005c5f2660a
Opcode Fuzzy Hash: 145f0dc581eb54d48936fad1517c7ca1c684cfcf59110d64dc2045c9b492cb24
Instruction Fuzzy Hash: 28214F75240301AFDB119FA4CCC9F9AB765BB48714F148278FE199E2CAC7B5A440CB61

Function 1102C600 Relevance: 16.7, APIs: 1, Strings: 10, Instructions: 197sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(000001F4,000000D0,110457C0,00000000), ref: 1102C7B4

Strings

*channel, xrefs: 1102C6FC, 1102C83C
SetChannel(%s), oldchan=<%s>, xrefs: 1102C733
gMain.cfg == m_cfg, xrefs: 1102C80A
Client, xrefs: 1102C701, 1102C841
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102C696, 1102C71F, 1102C753, 1102C778, 1102C7CD, 1102C827
_License, xrefs: 1102C675
licensee, xrefs: 1102C670
CLIENT32.CPP, xrefs: 1102C805
IsA(), xrefs: 1102C69B, 1102C724, 1102C758, 1102C77D, 1102C7D2, 1102C82C
Eval, xrefs: 1102C6A8

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Sleep
String ID: *channel$CLIENT32.CPP$Client$Eval$IsA()$SetChannel(%s), oldchan=<%s>$_License$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$gMain.cfg == m_cfg$licensee
API String ID: 3472027048-4290831010
Opcode ID: 47cd7c3719ed29ff5f7b17a723ba590415286500c907f12fbe8a287c7447fd4f
Instruction ID: 162b22d0950c33ebd3ce6122cc81dacbede348e260dc88c052d10cb763273ed6
Opcode Fuzzy Hash: 47cd7c3719ed29ff5f7b17a723ba590415286500c907f12fbe8a287c7447fd4f
Instruction Fuzzy Hash: CC718C38E0051AABDB00DBE4DD94FEEF7B4AF84708F508198E921672D0DB747905CBA1

Function 11016720 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 161windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 110CCB40: GetDlgItem.USER32(?,000017DD), ref: 110CCB94
Part of subcall function 110CCB40: ShowWindow.USER32(00000000,00000000,?,?,11181FCB,000000FF,?,11016756,?,D68DEC44), ref: 110CCBB9
Part of subcall function 110CCB40: GetWindowRect.USER32(00000000,000000FF), ref: 110CCC3B
Part of subcall function 110CCB40: GetWindowLongA.USER32(00000000,000000F0), ref: 110CCC7B

GetDlgItem.USER32(?,000004C6), ref: 110167C3
SendMessageA.USER32(?,00001037,00000000,00000000), ref: 11016816
SendMessageA.USER32(?,00001036,00000000,00000000), ref: 11016829
LoadLibraryA.KERNEL32(User32.dll), ref: 1101686B
EnumWindows.USER32(Function_000164F0,?), ref: 110168BF
FreeLibrary.KERNEL32(?), ref: 110168D3
FreeLibrary.KERNEL32(?), ref: 110168E0

Strings

User32.dll, xrefs: 11016866
explorer, xrefs: 1101683D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryWindow$FreeItemMessageSend$EnumLoadLongRectShowWindows
String ID: User32.dll$explorer
API String ID: 3666277573-2144398479
Opcode ID: 872f2cecf821a423838aa083082f5a9ec7ac2b6c5e64e19f8d44193f16581ceb
Instruction ID: aafd6012a2c7d05268e8d7e853bf9d0da619e18aec74808f6ad5a4f8f20ba1e6
Opcode Fuzzy Hash: 872f2cecf821a423838aa083082f5a9ec7ac2b6c5e64e19f8d44193f16581ceb
Instruction Fuzzy Hash: B85116B4E00308AFDB10CFAAC884A9EFBF9FF89704F10455AE555EB394D6B5A940CB50

Function 1100B7D0 Relevance: 15.9, APIs: 5, Strings: 4, Instructions: 149COMMON

Download Yara Rule

APIs

GetOverlappedResult.KERNEL32(?,D68DEA04,FFFFFFFF,00000001), ref: 1100B81C
GetLastError.KERNEL32 ref: 1100B826
GetTickCount.KERNEL32 ref: 1100B889
wsprintfA.USER32 ref: 1100B8C6
ResetEvent.KERNEL32(?), ref: 1100B97F

Strings

New hooked channels,bitspersample=%d,%d (old %d,%d), xrefs: 1100B904, 1100B967
Audio, xrefs: 1100B920, 1100B940
Hook_bits_per_sample, xrefs: 1100B93B
Hook_channels, xrefs: 1100B91B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountErrorEventLastOverlappedResetResultTickwsprintf
String ID: Audio$Hook_bits_per_sample$Hook_channels$New hooked channels,bitspersample=%d,%d (old %d,%d)
API String ID: 3598861413-432254317
Opcode ID: 83571795e4f36bd5ead8efd3995862b48a18342f7b29776b37533666f832ea7c
Instruction ID: dfa7a5ca73601b77426a840877f953fe0802a88257accf4bff2bc2ff8b95b50a
Opcode Fuzzy Hash: 83571795e4f36bd5ead8efd3995862b48a18342f7b29776b37533666f832ea7c
Instruction Fuzzy Hash: DF51E3B8D00A16ABE710DF64CC84ABBB7F8EF45758F00451EF56552281E7747A80C7A5

Function 110264A0 Relevance: 15.9, APIs: 4, Strings: 5, Instructions: 143COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 110264E3

Part of subcall function 11080A00: _strrchr.LIBCMT ref: 11080A0E

Part of subcall function 110F3EA0: LoadLibraryA.KERNEL32(Kernel32.dll,D68DEC44,?,00000000,?), ref: 110F3EDF
Part of subcall function 110F3EA0: GetCurrentProcessId.KERNEL32 ref: 110F3F21
Part of subcall function 110F3EA0: GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 110F3F2E
Part of subcall function 110F3EA0: FreeLibrary.KERNEL32(?), ref: 110F3FCB

wsprintfA.USER32 ref: 11026519
wsprintfA.USER32 ref: 11026585
wsprintfA.USER32 ref: 110265BD

Strings

TraceModuleName, xrefs: 110264BF
%d.exe, xrefs: 11026512
trace, xrefs: 11026566
_Debug, xrefs: 110265FB
tracefile, xrefs: 1102659F

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$Library$AddressCurrentFileFreeLoadModuleNameProcProcess_strrchr
String ID: %d.exe$TraceModuleName$_Debug$trace$tracefile
API String ID: 3659486034-589725905
Opcode ID: af921a9e6ec56a3d11847829a84b93200dd39c36b3ad04eabe9531d20c51b7d8
Instruction ID: e63fbb99c025b0a2463009545f27b4c81ae815fdfcd61f076bbed3dc435fd031
Opcode Fuzzy Hash: af921a9e6ec56a3d11847829a84b93200dd39c36b3ad04eabe9531d20c51b7d8
Instruction Fuzzy Hash: AB414B35F0412A6BCB01CF69AD80BFEF3A8DF85318F5041E9ED5AC7244DA31AA1487E1

Function 1110D1E0 Relevance: 15.9, APIs: 7, Strings: 2, Instructions: 111synchronizationCOMMON

Download Yara Rule

APIs

DeleteCriticalSection.KERNEL32(?,D68DEC44,?,?,?,?,00000000,1117E388,000000FF,?,1100CAFD), ref: 1110D22A
EnterCriticalSection.KERNEL32 ref: 1110D275
SetEvent.KERNEL32(?), ref: 1110D29E
CloseHandle.KERNEL32(?), ref: 1110D2D2
WaitForSingleObject.KERNEL32(?,000000FF), ref: 1110D2E0
CloseHandle.KERNEL32(?), ref: 1110D2ED
LeaveCriticalSection.KERNEL32(111EB518), ref: 1110D32E

Strings

..\ctl32\Refcount.cpp, xrefs: 1110D214
idata->Q.size () == 0, xrefs: 1110D219

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CloseHandle$DeleteEnterEventLeaveObjectSingleWait
String ID: ..\ctl32\Refcount.cpp$idata->Q.size () == 0
API String ID: 2474944948-424854974
Opcode ID: 34ead768e29220a218b3b67c442475a6cf5d74ef288cdce47848f5df5d145d0f
Instruction ID: 025ae749eb48e06233ddb0a0db0e6b13491740428c64ed129ca30ea448d4bf97
Opcode Fuzzy Hash: 34ead768e29220a218b3b67c442475a6cf5d74ef288cdce47848f5df5d145d0f
Instruction Fuzzy Hash: AB417EB5D026259FCB02CFE4C9C492EF7A4FB09318B94497DE526D3744D730A900CBA5

Function 110275C0 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 89COMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(00000028,?), ref: 110275DF
OpenProcessToken.ADVAPI32(00000000), ref: 110275E6
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,00000000,?), ref: 11027608
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?), ref: 11027628
LookupPrivilegeNameA.ADVAPI32(00000000,00000004,?,?), ref: 11027649
_free.LIBCMT ref: 11027674
CloseHandle.KERNEL32(?), ref: 11027686

Strings

@, xrefs: 1102763E
Luid Low=%x, High=%x, Attr=%x, name=%s, xrefs: 1102765E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Token$InformationProcess$CloseCurrentHandleLookupNameOpenPrivilege_free
String ID: @$Luid Low=%x, High=%x, Attr=%x, name=%s
API String ID: 2058255784-3275751932
Opcode ID: 854634e1335504d5c5c016b4e53581ce6dd4933ccb8a2325026052a6538fdada
Instruction ID: 80fcad38324fe0539d9ea6ec8fdc98bed3aa7570a2d11442cc491ea108380f98
Opcode Fuzzy Hash: 854634e1335504d5c5c016b4e53581ce6dd4933ccb8a2325026052a6538fdada
Instruction Fuzzy Hash: C92193B1E00219ABDB10CBE4CC84EAFFBBDEF48704F148119EA15A7140D730A906CBA1

Function 11002590 Relevance: 15.2, APIs: 10, Instructions: 155COMMON

Download Yara Rule

APIs

SetROP2.GDI32(?,00000007), ref: 110025A1
SelectObject.GDI32(?,?), ref: 110025B2
MoveToEx.GDI32(?,?,?,00000000), ref: 1100261F
LineTo.GDI32(?,00000000,?), ref: 11002656
MoveToEx.GDI32(?,?,?,00000000), ref: 11002719
LineTo.GDI32(?,?,?), ref: 11002728
LineTo.GDI32(?,?,?), ref: 11002733
LineTo.GDI32(?,?,?), ref: 1100273E
SelectObject.GDI32(?,?), ref: 11002745
SetROP2.GDI32(?,?), ref: 11002750

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Line$MoveObjectSelect
String ID:
API String ID: 3849273610-0
Opcode ID: 326889f15a2c58b6cc2322dd2282e9e825d49141d462ded4fd937b33979e1512
Instruction ID: 024bf9530bcbbf35c20787c8ebe241dc6a899ecf2bc9b4fd8ffc89da13eaefde
Opcode Fuzzy Hash: 326889f15a2c58b6cc2322dd2282e9e825d49141d462ded4fd937b33979e1512
Instruction Fuzzy Hash: 99519475D0062EEBCB44DFA4C9849EEFBB8FF49314F11C429E96563214CB306951CB61

Function 111543A0 Relevance: 15.1, APIs: 10, Instructions: 118windowCOMMON

Download Yara Rule

APIs

CreateCompatibleDC.GDI32(?), ref: 111543DD
SelectObject.GDI32(00000000,00000000), ref: 111543F3
GetClientRect.USER32(?,?), ref: 11154406
MapWindowPoints.USER32(?,00000001,?,00000002), ref: 11154420
GetObjectA.GDI32(00000000,00000018,?), ref: 1115444B
SetStretchBltMode.GDI32(?,00000004), ref: 11154457
StretchBlt.GDI32(?,?,?,?,00000001,00000000,00000000,00000000,?,?,00CC0020), ref: 11154487
SelectObject.GDI32(00000000,?), ref: 11154492
DeleteDC.GDI32(00000000), ref: 11154495

Part of subcall function 11153B10: GetDIBits.GDI32(?,?,00000000,?,?,?,00000000), ref: 11153BCF

DeleteObject.GDI32(00000000), ref: 111544E2

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$DeleteSelectStretch$BitsClientCompatibleCreateModePointsRectWindow
String ID:
API String ID: 376215049-0
Opcode ID: 27f705fdb4f735de7763c5d621974e85e08ef87a7f63107e710a76d9f1a960ac
Instruction ID: b9a41c18520ee0c5e7b1149d6b89d9e445b23d1f488621e843f056dc368946bb
Opcode Fuzzy Hash: 27f705fdb4f735de7763c5d621974e85e08ef87a7f63107e710a76d9f1a960ac
Instruction Fuzzy Hash: 55416975A40205AFD754CFA4C888FEFF7F9EB88714F10852DEA6AA7240DB70A941CB51

Function 11019170 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 158COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11019190

Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C758
Part of subcall function 1115C743: __CxxThrowException@8.LIBCMT ref: 1115C76D
Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C77E

_memmove.LIBCMT ref: 11019217
_memmove.LIBCMT ref: 1101923B
_memmove.LIBCMT ref: 11019275
_memmove.LIBCMT ref: 11019291
std::exception::exception.LIBCMT ref: 110192DB
__CxxThrowException@8.LIBCMT ref: 110192F0

Strings

deque<T> too long, xrefs: 1101918B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove$std::exception::exception$Exception@8Throw$Xinvalid_argumentstd::_
String ID: deque<T> too long
API String ID: 827257264-309773918
Opcode ID: 00e811b5f475ccf7d6075099a2384d186b95a0e5d8e2665126563db006499260
Instruction ID: 2cadbd9f83a1a984a370d62cf67e49853a3473016cf8af100feb14984ba87579
Opcode Fuzzy Hash: 00e811b5f475ccf7d6075099a2384d186b95a0e5d8e2665126563db006499260
Instruction Fuzzy Hash: 6D4188B6E00215ABDB44CE68CC816EEF7F9EF94218F19C569DC19DB308F674EA418790

Function 11009700 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 148fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110B6980: GetModuleHandleA.KERNEL32(kernel32.dll,ProcessIdToSessionId,00000000,00000000), ref: 110B69A6
Part of subcall function 110B6980: GetProcAddress.KERNEL32(00000000), ref: 110B69AD
Part of subcall function 110B6980: GetCurrentProcessId.KERNEL32(00000000), ref: 110B69C3

wsprintfA.USER32 ref: 1100973F
wsprintfA.USER32 ref: 11009759
CreateFileA.KERNEL32(?,40000000,00000000,00000000,00000002,00000080,00000000), ref: 11009843

Strings

Store\, xrefs: 110097E0
%s%s.htm, xrefs: 11009753
.%u, xrefs: 11009739
ApprovedWebList, xrefs: 11009748

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$AddressCreateCurrentFileHandleModuleProcProcess
String ID: %s%s.htm$.%u$ApprovedWebList$Store\
API String ID: 559337438-1872371932
Opcode ID: aa23adb00c0790e2b864c15f9871f0c94c34239e2f2793565f9795f6ab2acec2
Instruction ID: 83f2b87e64f4799d5389d038580c867e807bdc7d572f41855fcbb847c0816554
Opcode Fuzzy Hash: aa23adb00c0790e2b864c15f9871f0c94c34239e2f2793565f9795f6ab2acec2
Instruction Fuzzy Hash: 6E51F531E0425E9BDB15CF789890BEAFBE4AB09344F1481E5D54DD7241FA30AA44CB90

Function 11004230 Relevance: 14.1, APIs: 4, Strings: 4, Instructions: 126COMMON

Download Yara Rule

APIs

Part of subcall function 11001EF0: FindWindowA.USER32(Progman,00000000), ref: 11001F19
Part of subcall function 11001EF0: GetWindowThreadProcessId.USER32(00000000,?), ref: 11001F27
Part of subcall function 11001EF0: OpenProcess.KERNEL32(001F0FFF,00000000,?), ref: 11001F3B
Part of subcall function 11001EF0: GetVersionExA.KERNEL32(?), ref: 11001F54
Part of subcall function 11001EF0: OpenProcessToken.ADVAPI32(00000000,0002000B,00000000), ref: 11001F70
Part of subcall function 11001EF0: ImpersonateLoggedOnUser.ADVAPI32(00000000), ref: 11001F81
Part of subcall function 11001EF0: CloseHandle.KERNEL32(00000000), ref: 11001F98
Part of subcall function 11001EF0: CloseHandle.KERNEL32(00000000), ref: 11001F9F

Part of subcall function 11141190: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 111411FD
Part of subcall function 11141190: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,00000000), ref: 1114123E
Part of subcall function 11141190: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114129B

EnableWindow.USER32(00000000,00000000), ref: 11004336
GetSaveFileNameA.COMDLG32(00000058), ref: 1100433F
EnableWindow.USER32(00000000,00000001), ref: 110043C3
RevertToSelf.ADVAPI32 ref: 110043C5

Strings

m_hWnd, xrefs: 1100431D, 110043B0
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11004318, 110043AB
BMP, xrefs: 11004307
X, xrefs: 1100428B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Process$CloseEnableFileFolderHandleNameOpenPath$FindImpersonateLoggedModuleRevertSaveSelfThreadTokenUserVersion
String ID: BMP$X$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2093866010-2539113696
Opcode ID: 361a1cf7a41bd3134dc45c5d86367acc62d7b6133a99de57cca7de034afb7f42
Instruction ID: 74aad9643e3342a821be83c146b3c0bd31c21b8642fff157daf4dea6524cc173
Opcode Fuzzy Hash: 361a1cf7a41bd3134dc45c5d86367acc62d7b6133a99de57cca7de034afb7f42
Instruction Fuzzy Hash: F641C374E403199BE725DF60CC41FDAB7F8EB48758F0085A8EA19A7281D775BA44CF90

Function 11117060 Relevance: 14.1, APIs: 6, Strings: 2, Instructions: 121windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(?,?,00000000), ref: 11117198
SelectPalette.GDI32(?,?,00000000), ref: 111171AE
DeleteObject.GDI32(?), ref: 111171BB
CreatePalette.GDI32(00000000), ref: 111171C8
SelectPalette.GDI32(?,00000000,00000000), ref: 111171DE
SelectPalette.GDI32(?,?,00000000), ref: 111171F6

Strings

..\ctl32\Remote.cpp, xrefs: 11117139
idata->dcafpal_offset < 256, xrefs: 1111713E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Palette$Select$CreateDeleteObject
String ID: ..\ctl32\Remote.cpp$idata->dcafpal_offset < 256
API String ID: 428128002-1312578601
Opcode ID: b895d41c703c489d43035cb6a39e841a45c82bfb5581bc351dc685ceda1eebbf
Instruction ID: 64efb511f165c85f40653dd8ab72717c0eb622aaa84b505a46ec083c52578755
Opcode Fuzzy Hash: b895d41c703c489d43035cb6a39e841a45c82bfb5581bc351dc685ceda1eebbf
Instruction Fuzzy Hash: 9441BEB8600B019BD720DF74C884BA7F7E9AF48304F10892CE69A9B380D774B945CB65

Function 110094C0 Relevance: 14.1, APIs: 3, Strings: 5, Instructions: 92fileCOMMON

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 110094FA
_strncmp.LIBCMT ref: 1100950A
WriteFile.KERNEL32(00000000,?,?,00000000,00000000,?,?,?,?,?,?,?,D68DEC44), ref: 110095AB

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11009560, 11009588
<tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td , xrefs: 11009531
http://, xrefs: 110094F5, 11009508
https://, xrefs: 110094EF
IsA(), xrefs: 11009565, 1100958D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _strncmp$FileWrite
String ID: <tr><td valign="middle" align="center"><p align="center"><img border="0" src="%s" align="left" width="16"> </p></td><td><p align="left"><font face="Verdana, Arial, Helvetica, sans-serif" size="2"><a>%s</a></font></p></td><td> </td><td $IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$http://$https://
API String ID: 1635020204-3154135529
Opcode ID: dff6f0b9609df62e46a3ec7725f6200f215b9130fd03584671ce3001097bc693
Instruction ID: 08fc25190e1d37b160b24b9dcd8b967082602f5a441756a8aab13f3c551db539
Opcode Fuzzy Hash: dff6f0b9609df62e46a3ec7725f6200f215b9130fd03584671ce3001097bc693
Instruction Fuzzy Hash: 45314F75E0065AABDB00DF95CC44FDEB7B8EF49754F004259F925B7280E735AA04CBA1

Function 11128760 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 78libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(IPHLPAPI.DLL,?,?,?,1102DCF1,?,?,11190210,Trying to get mac addr for %u.%u.%u.%u,?,000000FF,?,?), ref: 11128785
GetProcAddress.KERNEL32(00000000,SendARP), ref: 1112879E
wsprintfA.USER32 ref: 111287EB
wsprintfA.USER32 ref: 11128803
FreeLibrary.KERNEL32(00000000,?,1102DCF1,?), ref: 11128818

Strings

SendARP, xrefs: 11128798
IPHLPAPI.DLL, xrefs: 11128778
%02x, xrefs: 111287FD

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Librarywsprintf$AddressFreeLoadProc
String ID: %02x$IPHLPAPI.DLL$SendARP
API String ID: 435568443-4085816232
Opcode ID: 3b530c19348f3df7045f7289fedabd34cf4fcd96a36115f97742d3a6271080a2
Instruction ID: f51838941bce14dc4456fc31b7ab1240e3bd3c823afa200c33cb30b4f2fbc345
Opcode Fuzzy Hash: 3b530c19348f3df7045f7289fedabd34cf4fcd96a36115f97742d3a6271080a2
Instruction Fuzzy Hash: 8D217472E0112A9BCB01DF95CD849EFFBF4EB49714F154128ED15A3300D7749901CBA1

Function 1100D770 Relevance: 13.6, APIs: 9, Instructions: 75libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,111918C0), ref: 1100D784
GetProcAddress.KERNEL32(00000000,111918B0), ref: 1100D798
GetProcAddress.KERNEL32(00000000,111918A0), ref: 1100D7AD
GetProcAddress.KERNEL32(00000000,11191890), ref: 1100D7C1
GetProcAddress.KERNEL32(00000000,11191884), ref: 1100D7D5
GetProcAddress.KERNEL32(00000000,11191864), ref: 1100D7EA
GetProcAddress.KERNEL32(00000000,11191844), ref: 1100D7FE
GetProcAddress.KERNEL32(00000000,11191834), ref: 1100D812
GetProcAddress.KERNEL32(00000000,11191824), ref: 1100D827

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc
String ID:
API String ID: 190572456-0
Opcode ID: 3d5ef8bd20ba1f80c987c86f62bf841767f67a2c4def2a460588c757e5b54ec8
Instruction ID: 99d27fa93890b0c7ef7424a3a62cbd4bc85b788dae6ec38e4cbc930d2990a117
Opcode Fuzzy Hash: 3d5ef8bd20ba1f80c987c86f62bf841767f67a2c4def2a460588c757e5b54ec8
Instruction Fuzzy Hash: 6031DEB9912A249FF706DBE4D8C4A36B7E8F788348F18417AE43583A4CD7749640DF90

Function 1109C3F0 Relevance: 13.6, APIs: 9, Instructions: 63fileCOMMON

Download Yara Rule

APIs

UnmapViewOfFile.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C3FF
CloseHandle.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C419
CloseHandle.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C426
CloseHandle.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C433
SetEvent.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C445
CloseHandle.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C44F
SetEvent.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C461
CloseHandle.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C46B
CloseHandle.KERNEL32(?,00000000,CCC35D5F,?,1109CBF6,1106FA4F,?,11065196,00000000,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F), ref: 1109C478

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$Event$FileUnmapView
String ID:
API String ID: 2427653990-0
Opcode ID: c3a08aac49613e4fce0eb7f93f5651dbaf868607e627456b4d7fc02c34986366
Instruction ID: cce53083dacabcaa7aaee88af7ab32c2f3f7f551c36a25cc2e945711098914c8
Opcode Fuzzy Hash: c3a08aac49613e4fce0eb7f93f5651dbaf868607e627456b4d7fc02c34986366
Instruction Fuzzy Hash: 9611F1B1E017459BD730DFAAC9D4826FBE9AE583003518D7EE19AC3610C730E4489F61

Function 11002760 Relevance: 13.6, APIs: 9, Instructions: 58COMMON

Download Yara Rule

APIs

SetROP2.GDI32(?,00000007), ref: 11002777
SelectObject.GDI32(?,?), ref: 1100278A
GetStockObject.GDI32(00000005), ref: 11002791
SelectObject.GDI32(?,00000000), ref: 11002799
Ellipse.GDI32(?,?,?,?,?), ref: 110027B7
Rectangle.GDI32(?,?,?,?,?), ref: 110027BF
SelectObject.GDI32(?,?), ref: 110027CA
SelectObject.GDI32(?,?), ref: 110027D1
SetROP2.GDI32(?,?), ref: 110027D8

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Select$EllipseRectangleStock
String ID:
API String ID: 1843601829-0
Opcode ID: 6d16e5b2d07782e95d2a284115ddcea055f87a165874b756e5624257e40393f5
Instruction ID: b7669a04c1c42056c6af56a4fd28cce2e553fab384a546d3d46dd7efa7aa8afe
Opcode Fuzzy Hash: 6d16e5b2d07782e95d2a284115ddcea055f87a165874b756e5624257e40393f5
Instruction Fuzzy Hash: A7112A75601114BFD701EFA8CC84EAFB7ADEF89310F118159FA0897204DB70AA018BA1

Function 1101D7A0 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

InflateRect.USER32(?,000000FF,000000FF), ref: 1101D814
InflateRect.USER32(?,000000FF,000000FF), ref: 1101D844
InflateRect.USER32(?,000000FF,000000FF), ref: 1101D868
GetBkColor.GDI32(?), ref: 1101D86E
GetTextColor.GDI32(?), ref: 1101D8F5

Strings

VUUU, xrefs: 1101D8A6
VUUU, xrefs: 1101D940

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InflateRect$Color$Text
String ID: VUUU$VUUU
API String ID: 1214208285-3149182767
Opcode ID: 30c1160f47e0db080298cbda41b0599c2ce7c2027c8300169789b101fcd43bf7
Instruction ID: 1c521c49254a22b1ef6ac5f930aaf46940fa761450f36526de14c12613745222
Opcode Fuzzy Hash: 30c1160f47e0db080298cbda41b0599c2ce7c2027c8300169789b101fcd43bf7
Instruction Fuzzy Hash: A7616275E0021A9BCB04DFA8D881AAEF7F5FF98324F148629E515E7385D634F905CB90

Function 1100A350 Relevance: 12.4, APIs: 2, Strings: 5, Instructions: 135COMMON

Download Yara Rule

APIs

_sprintf.LIBCMT ref: 1100A3D5
_sprintf.LIBCMT ref: 1100A417

Strings

f[%d]=%f, < -1.0, xrefs: 1100A411
f[%d]=%f, > 1.0, xrefs: 1100A3CF
Error. soundlevel > 32767, xrefs: 1100A451
Warning. %s, xrefs: 1100A3DE, 1100A420
Error. soundlevel < -32768 , xrefs: 1100A465

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _sprintf
String ID: Error. soundlevel < -32768 $Error. soundlevel > 32767$Warning. %s$f[%d]=%f, < -1.0$f[%d]=%f, > 1.0
API String ID: 1467051239-371636152
Opcode ID: 7004af97422e4d167f624786689b5cfd48caf4d7341bc964f266a13e840c07fa
Instruction ID: 6b7e6607031253b629876a219b6c92ae987a59ebb78139586c6fa8ac368404f4
Opcode Fuzzy Hash: 7004af97422e4d167f624786689b5cfd48caf4d7341bc964f266a13e840c07fa
Instruction Fuzzy Hash: F7415876E04249DBD700DFB8C8846ECFBB4FF85254F6542BDD8981B346EA316485CBA0

Function 110652F0 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 107timeCOMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,D68DEC44,?,00000000,001D8E64), ref: 11065330
SetEvent.KERNEL32 ref: 1106535A
timeGetTime.WINMM ref: 11065393
InterlockedDecrement.KERNEL32(?), ref: 110653B0
_free.LIBCMT ref: 11065438
LeaveCriticalSection.KERNEL32(?), ref: 11065441

Strings

Unpausing sessionz %dz, rxpending = %d, lag = %d, pausedfor %d ms, xrefs: 1106540E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$DecrementEnterEventInterlockedLeaveTime_freetime
String ID: Unpausing sessionz %dz, rxpending = %d, lag = %d, pausedfor %d ms
API String ID: 1154861362-2729525473
Opcode ID: dae3e0adc72b8eea6f496e8e3c66575684a58fe5ea8678d68465c34b4b90f71c
Instruction ID: 3a2010e12194338b56e8f932d1506b24b336dbef52d95c878f60a9119effae7e
Opcode Fuzzy Hash: dae3e0adc72b8eea6f496e8e3c66575684a58fe5ea8678d68465c34b4b90f71c
Instruction Fuzzy Hash: D0417875A00A159FC715CF64C984BAAF7F9FB48349F00856DE86A97354DB31FA00CBA1

Function 11005180 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1100518E
GetMenuItemID.USER32(?,00000000), ref: 110051C4
CheckMenuItem.USER32(?,00000000,00000000), ref: 11005221
EnableMenuItem.USER32(?,00000000,00000000), ref: 11005237
GetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005258
SetMenuItemInfoA.USER32(?,00000000,00000001,00000030), ref: 11005284

Strings

0, xrefs: 110051BD

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMenu$Info$CheckCountEnable
String ID: 0
API String ID: 4290561058-4108050209
Opcode ID: a8723de7deb99a3142d8ee8d2b06fcf99ef3b56327b675c4da9f5fd855227273
Instruction ID: 8088bb3788be77518da4af7ece333fa97ab93b56969fcd5de4fb30b0916015f6
Opcode Fuzzy Hash: a8723de7deb99a3142d8ee8d2b06fcf99ef3b56327b675c4da9f5fd855227273
Instruction Fuzzy Hash: A0318D70D0211ABBEB01DFA4D888BEEBBFCEF46398F008059F951E6240E7759A44CB51

Function 110CC1B0 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 104COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(00000000,?), ref: 110CC22B
GetWindowRect.USER32(?,?), ref: 110CC239
MapWindowPoints.USER32(00000000,?,00000018,00000002), ref: 110CC274

Strings

m_hWnd, xrefs: 110CC213
hWnd, xrefs: 110CC1DA
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110CC20E
..\ctl32\nsmdlg.cpp, xrefs: 110CC1D5

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Rect$Points
String ID: ..\ctl32\nsmdlg.cpp$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$hWnd$m_hWnd
API String ID: 670989891-3958695921
Opcode ID: afa3b4a812a5968a178dd48e2bfee975a7a8665ee46d7a0603612b7006b12290
Instruction ID: ebef4da548833f6da56f03c111c72eddc7bd9583c9ddf6efbff45626426a567c
Opcode Fuzzy Hash: afa3b4a812a5968a178dd48e2bfee975a7a8665ee46d7a0603612b7006b12290
Instruction Fuzzy Hash: FE414E75A0060AAFCB04CF99C980EAAFBB5FF48714B10C199E919AB755D730F945CFA0

Function 11010320 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1101034D
std::_Lockit::_Lockit.LIBCPMT ref: 11010370
std::bad_exception::bad_exception.LIBCMT ref: 110103F4
__CxxThrowException@8.LIBCMT ref: 11010402
std::_Lockit::_Lockit.LIBCPMT ref: 11010415
std::locale::facet::_Facet_Register.LIBCPMT ref: 1101042F

Strings

bad cast, xrefs: 110103EC

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: f4208c92169566b3eaf1312dcccfcd990592ecb0014104223b2ca5a0791bef32
Instruction ID: e6e49762bbe1e61068859b2b4cf9e46a9385ddab2bc4a76d1355776dcf54d6bf
Opcode Fuzzy Hash: f4208c92169566b3eaf1312dcccfcd990592ecb0014104223b2ca5a0791bef32
Instruction Fuzzy Hash: 6E31CB75D015559BD755CF94C880BEFF7B8FB05328F00465AE865AB288EB34B940CBD1

Function 1100F700 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 102COMMON

Download Yara Rule

APIs

std::_Lockit::_Lockit.LIBCPMT ref: 1100F72D
std::_Lockit::_Lockit.LIBCPMT ref: 1100F750
std::bad_exception::bad_exception.LIBCMT ref: 1100F7D4
__CxxThrowException@8.LIBCMT ref: 1100F7E2
std::_Lockit::_Lockit.LIBCPMT ref: 1100F7F5
std::locale::facet::_Facet_Register.LIBCPMT ref: 1100F80F

Strings

bad cast, xrefs: 1100F7CC

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LockitLockit::_std::_$Exception@8Facet_RegisterThrowstd::bad_exception::bad_exceptionstd::locale::facet::_
String ID: bad cast
API String ID: 2427920155-3145022300
Opcode ID: 1675ffb4177e46c2e7db32118c5bdfede430cbed07243e56872a22429b7e388e
Instruction ID: 1a9131e07049ca647599b3314af25119d7159ff09530490266539396f9b5c329
Opcode Fuzzy Hash: 1675ffb4177e46c2e7db32118c5bdfede430cbed07243e56872a22429b7e388e
Instruction Fuzzy Hash: 9D31A435D012169BEB55CF94C880BEEF7B4FF45368F1042ADD825A7280EB31AA40CB93

Function 110CE3B0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 95COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 110CE498

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 110CE3F1, 110CE44E
..\CTL32\NSMString.cpp, xrefs: 110CE3C7, 110CE40D, 110CE42B, 110CE46D, 110CE4B7
iAt+nUnits<=Length(), xrefs: 110CE472
iAt>=0 && iAt<Length(), xrefs: 110CE412
IsA(), xrefs: 110CE3CC, 110CE3F6, 110CE453, 110CE4BC
nUnits>=0, xrefs: 110CE430

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: ..\CTL32\NSMString.cpp$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h$iAt+nUnits<=Length()$iAt>=0 && iAt<Length()$nUnits>=0
API String ID: 4104443479-2510446908
Opcode ID: a2f7c2c24e196ebe983ec0b839d1e8574078d24a3b0b38f4fe1b8181d1811d55
Instruction ID: 401ecc9782628e18a71157b09f4437c0de9aa64d1f2a499edb50e8af9ec5f81a
Opcode Fuzzy Hash: a2f7c2c24e196ebe983ec0b839d1e8574078d24a3b0b38f4fe1b8181d1811d55
Instruction Fuzzy Hash: 3E21367CF006163BD710EF59FC91F8DBB958F9464871480A8F95527281EB32B905CAE1

Function 110EF410 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 85fileCOMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000,00000000), ref: 110EF465
GetShortPathNameA.KERNEL32(?,?,00000104), ref: 110EF47A

Part of subcall function 11080A00: _strrchr.LIBCMT ref: 11080A0E

CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 110EF4D3
CreateFileA.KERNEL32(?,00000000,00000000,00000000,00000000,04000000,00000000), ref: 110EF518

Strings

\\.\, xrefs: 110EF44B
nsmvxd.386, xrefs: 110EF49B
pcdvxd.386, xrefs: 110EF4DD

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CreateName$ModulePathShort_strrchr
String ID: \\.\$nsmvxd.386$pcdvxd.386
API String ID: 1318148156-3179819359
Opcode ID: 0a4a0c031b2b427ab7e21903934bfa50da60d22c20210a339ee4994eeb461289
Instruction ID: a8e626f49853bc243716ffabc4902576affeea1819798eb9da2882ec1e8e6572
Opcode Fuzzy Hash: 0a4a0c031b2b427ab7e21903934bfa50da60d22c20210a339ee4994eeb461289
Instruction Fuzzy Hash: 1631C430A00769AFD320DF24C880B86BBF4AB08714F008168E3A9DB2C4D3B2B584CF81

Function 110803B0 Relevance: 12.3, APIs: 1, Strings: 6, Instructions: 79COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 11080459

Strings

nBytes>=0, xrefs: 110803ED
..\CTL32\DataStream.cpp, xrefs: 110803CA, 110803E8, 1108040F, 1108042C, 1108046F, 11080496
pData, xrefs: 11080414
m_nLength>=nBytes, xrefs: 11080474
IsA(), xrefs: 110803CF, 1108049B
!m_bReadOnly, xrefs: 11080431

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: !m_bReadOnly$..\CTL32\DataStream.cpp$IsA()$m_nLength>=nBytes$nBytes>=0$pData
API String ID: 4104443479-3417006389
Opcode ID: 5965a97a427b0220dacb1fe3953e5e85c1b678a924361328110300ad04a7f5dd
Instruction ID: a65d92a2520133a09b767f43f8eae5d7d21a0cd6f81397b9de842b1e9b4b5f1f
Opcode Fuzzy Hash: 5965a97a427b0220dacb1fe3953e5e85c1b678a924361328110300ad04a7f5dd
Instruction Fuzzy Hash: 3721E77DF406666BC711FE0AEC40F8BB7986FD0758F04D06CF6A527282E979B40486A6

Function 11031250 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 68libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(Kernel32.dll,D68DEC44,D68DEC44,11069A9E,?,?,?,?,?,?,?,?,?,?,00000000,1117B7D8), ref: 11031282
GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,1117B7D8,000000FF,?,1103135B,?,11065185), ref: 110312C0
GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 110312CE
SetLastError.KERNEL32(00000078,?,?,?,?,?,?,?,?,?,00000000,1117B7D8,000000FF,?,1103135B), ref: 110312E6
FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,1117B7D8,000000FF,?,1103135B), ref: 110312F4

Strings

Kernel32.dll, xrefs: 1103127A
ProcessIdToSessionId, xrefs: 110312C6

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCurrentErrorFreeLastLoadProcProcess
String ID: Kernel32.dll$ProcessIdToSessionId
API String ID: 1613046405-2825297712
Opcode ID: d9bbe5a07f76249bf03235f2471cb6cc90b9f97032f132e617b3f8da1c1db5eb
Instruction ID: 2ce6ed7d88e0370322fb4ee3bfb2318ea0590810629ca121a47833b4c716093e
Opcode Fuzzy Hash: d9bbe5a07f76249bf03235f2471cb6cc90b9f97032f132e617b3f8da1c1db5eb
Instruction Fuzzy Hash: 6F21B0B1D21229AFCB01DF99D88499EFFB8FB48B11F10452BF525E3244D7B419018BA5

Function 1112F210 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 66libraryloadertimeCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,DwmEnableComposition), ref: 1112F261
KillTimer.USER32(?,00000081,D68DEC44,001D9EB6,00000000,00000000,11187091,000000FF), ref: 1112F2A1
GlobalDeleteAtom.KERNEL32 ref: 1112F2BD
FreeLibrary.KERNEL32(?,?,D68DEC44,001D9EB6,00000000,00000000,11187091,000000FF), ref: 1112F2CE

Strings

m_hWnd, xrefs: 1112F28B
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1112F286
DwmEnableComposition, xrefs: 1112F25B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressAtomDeleteFreeGlobalKillLibraryProcTimer
String ID: DwmEnableComposition$e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 239104392-413893893
Opcode ID: b253b6a761ad71060c2435e66734449b0cdc8dd4bfdfe9db1dcdf5faaa963031
Instruction ID: 24bcb194f1df02f77b6cbe4c96a83dc5cfe5c9de3b2a7801dada8c241fd5e367
Opcode Fuzzy Hash: b253b6a761ad71060c2435e66734449b0cdc8dd4bfdfe9db1dcdf5faaa963031
Instruction Fuzzy Hash: 9021D175A00716EFD721CFA5C844B9AF7F8FB0A708F108A2DE47A93680D774A440CB62

Function 1115B470 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 50COMMON

Download Yara Rule

APIs

SetForegroundWindow.USER32(00000000), ref: 1115B49E
SystemParametersInfoA.USER32(00002000,00000000,00000001,00000000), ref: 1115B4BF
SystemParametersInfoA.USER32(00002001,00000000,00000000,00000000), ref: 1115B4CC
SetForegroundWindow.USER32(00000000), ref: 1115B4D2
SystemParametersInfoA.USER32(00002001,00000000,00000001,00000000), ref: 1115B4E7

Strings

m_hWnd, xrefs: 1115B487
..\ctl32\wndclass.cpp, xrefs: 1115B482

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InfoParametersSystem$ForegroundWindow
String ID: ..\ctl32\wndclass.cpp$m_hWnd
API String ID: 3399305081-2201682149
Opcode ID: 0cabb1cbfc0ff4e9b34373751908436debe38cfcda5226fe8c506a216f1c674f
Instruction ID: 59ee6e41974cfee1cd8d287b9ff4622f8bd2b89e33ec88b4fc1633965968244d
Opcode Fuzzy Hash: 0cabb1cbfc0ff4e9b34373751908436debe38cfcda5226fe8c506a216f1c674f
Instruction Fuzzy Hash: A301D632B50319BBE310DA99CC4AF59F7ACEB44B14F108126F708A71C0E6F1A860CBE5

Function 11003370 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 41windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFF), ref: 1100337E
GetSubMenu.USER32(00000000,00000000), ref: 110033AA
GetSubMenu.USER32(00000000,00000000), ref: 110033CC
DestroyMenu.USER32(00000000), ref: 110033DA

Strings

hSub, xrefs: 110033BC
..\CTL32\annotate.cpp, xrefs: 1100338F, 110033B7
hMenu, xrefs: 11003394

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyLoad
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 588275208-934300333
Opcode ID: 16b6232f67adfd498cadec61214c6d947f0fd21b94db3df087ffeb60ecc13b78
Instruction ID: 532e6885f23f88a850f456ec9086f52e50b690d757024d8a31f3b0ecd7c38b88
Opcode Fuzzy Hash: 16b6232f67adfd498cadec61214c6d947f0fd21b94db3df087ffeb60ecc13b78
Instruction Fuzzy Hash: C1F0E97AF4063276D31361A96C85F4FE74C8BD1AECF124070F614FA680EA10A80082EB

Function 11003280 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 37windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF9), ref: 1100328D
GetSubMenu.USER32(00000000,00000000), ref: 110032B3
GetMenuItemCount.USER32(00000000), ref: 110032D7
DestroyMenu.USER32(00000000), ref: 110032E9

Strings

hSub, xrefs: 110032C9
..\CTL32\annotate.cpp, xrefs: 1100329E, 110032C4
hMenu, xrefs: 110032A3

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$CountDestroyItemLoad
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 2017816088-934300333
Opcode ID: 82956ede6060959b3ec7f472aaf26a8c76352647024e1f37fa024a270c1e96b7
Instruction ID: cb5865bd2d65b0c3a6446b412fb350df719b968061f06b7dda97a72bfd439da7
Opcode Fuzzy Hash: 82956ede6060959b3ec7f472aaf26a8c76352647024e1f37fa024a270c1e96b7
Instruction Fuzzy Hash: FAF0E23AF00533B7C31362A93C08F8FF7588BC1AECF164070F911BA681EA20A400C2E6

Function 110047D0 Relevance: 12.2, APIs: 8, Instructions: 209windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 110047EC
DeleteObject.GDI32(?), ref: 110049F0
CreateCompatibleBitmap.GDI32(?,?,?), ref: 11004A44
CreateCompatibleDC.GDI32(?), ref: 11004A69
SelectObject.GDI32(00000000,00000000), ref: 11004A7D
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,?,?,00CC0020), ref: 11004AA3
SelectObject.GDI32(00000000,?), ref: 11004AAE
DeleteDC.GDI32(00000000), ref: 11004AB5

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$Delete$CompatibleCreateSelect$Bitmap
String ID:
API String ID: 4070257480-0
Opcode ID: e165d7818108aea53dcf96a38967e2dc95c56aac9eb7b783a0ab2907855d5840
Instruction ID: d9298024016e85785e9fb38684a3a01fe995eed50145ce0fa49cd24ba90b575e
Opcode Fuzzy Hash: e165d7818108aea53dcf96a38967e2dc95c56aac9eb7b783a0ab2907855d5840
Instruction Fuzzy Hash: 10B148B8A00B019FD365CF29C580B96FBE5BF88304F108A2EE9AE93754D770B845CB54

Function 11154510 Relevance: 12.1, APIs: 8, Instructions: 124COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11154529

Part of subcall function 1114FA10: GetWindowTextLengthA.USER32(00000000), ref: 1114FA34

Part of subcall function 11001D30: GetWindowTextA.USER32(?,?,?), ref: 11001D5F

SelectObject.GDI32(?,?), ref: 11154589
MapWindowPoints.USER32(?,?,?,00000002), ref: 111545BD
SetBkMode.GDI32(?,00000001), ref: 111545F6
SetTextColor.GDI32(?,?), ref: 11154607

Part of subcall function 11141A00: GetVersionExA.KERNEL32(?), ref: 11141A5E
Part of subcall function 11141A00: LoadLibraryA.KERNEL32(kernel32.dll), ref: 11141A85
Part of subcall function 11141A00: GetProcAddress.KERNEL32(00000000,GetUserDefaultUILanguage), ref: 11141A97
Part of subcall function 11141A00: FreeLibrary.KERNEL32(00000000), ref: 11141AAF
Part of subcall function 11141A00: GetSystemDefaultLangID.KERNEL32 ref: 11141ABA

DrawTextA.USER32(?,00000000,000000FF,?,00022010), ref: 1115462E
SelectObject.GDI32(?,?), ref: 1115463C
_free.LIBCMT ref: 1115464D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: TextWindow$LibraryObjectSelect$AddressColorDefaultDrawFreeLangLengthLoadModePointsProcSystemVersion_free
String ID:
API String ID: 712990509-0
Opcode ID: f593a3a758e3a195c2e6fe76d7a58d7784ca3089c89cd5f0b8e476debafd7ef4
Instruction ID: 400a414dedd9210391a7997f0f2825b85c05d8dd65265aca28f7f270372d748b
Opcode Fuzzy Hash: f593a3a758e3a195c2e6fe76d7a58d7784ca3089c89cd5f0b8e476debafd7ef4
Instruction Fuzzy Hash: 82415975200701ABD7A0DB64C988F9BF3E9AF89718F10891DE96A97290DB74F841CB61

Function 11025066 Relevance: 12.1, APIs: 8, Instructions: 117windowCOMMON

Download Yara Rule

APIs

GetWindowTextA.USER32(?,?,00000050), ref: 110250B6
_strncat.LIBCMT ref: 110250CB
SetWindowTextA.USER32(?,?), ref: 110250D8
GetDlgItemTextA.USER32(?,00001395,?,00000040), ref: 11025161
GetDlgItemTextA.USER32(?,00001397,?,00000040), ref: 11025175
SetDlgItemTextA.USER32(?,00001397,?), ref: 1102518D
SetDlgItemTextA.USER32(?,00001395,?), ref: 1102519F
SetFocus.USER32(?), ref: 110251A2

Part of subcall function 11024BC0: GetDlgItem.USER32(?,?), ref: 11024C10

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Text$Item$Window$Focus_strncat
String ID:
API String ID: 3219897423-0
Opcode ID: 391ddf91cbebd7915805f29ae583d763afe5bfa50f9fc9a6ffddfc9652ac4fbc
Instruction ID: f41385c4b327a7b4b4ee8056a6fa87f3566041a9593aa277c4389ade70ae70f6
Opcode Fuzzy Hash: 391ddf91cbebd7915805f29ae583d763afe5bfa50f9fc9a6ffddfc9652ac4fbc
Instruction Fuzzy Hash: 7441B6B1A00359AFE710DBA4CC85FAEF7F8EB44714F114969E61AD76C0E670A940CB50

Function 110ED5E0 Relevance: 12.1, APIs: 8, Instructions: 84filememoryCOMMON

Download Yara Rule

APIs

GetFileSize.KERNEL32(00000000,00000000,00000000,00000000,00000000,00000000,?,1112E9F6,00000000,?), ref: 110ED5F8
ReadFile.KERNEL32(00000000,00000000,0000000E,?,00000000,?,1112E9F6,00000000,?), ref: 110ED60D
GlobalAlloc.KERNEL32(00000042,-0000000E,00000000), ref: 110ED62F
GlobalLock.KERNEL32(00000000), ref: 110ED63C
ReadFile.KERNEL32(00000000,00000000,-0000000E,0000000E,00000000), ref: 110ED64B
GlobalUnlock.KERNEL32(00000000), ref: 110ED65B
GlobalUnlock.KERNEL32(00000000), ref: 110ED675
GlobalFree.KERNEL32(00000000), ref: 110ED67C

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Global$File$ReadUnlock$AllocFreeLockSize
String ID:
API String ID: 3489003387-0
Opcode ID: beef7ace71669c2ff7b1b95e2db707058991072b7bf05e421647bf19f08c7069
Instruction ID: 97e92853dc1e047ed0c3eeda64a735dce235f03bcca91e6039f12a838859fea6
Opcode Fuzzy Hash: beef7ace71669c2ff7b1b95e2db707058991072b7bf05e421647bf19f08c7069
Instruction Fuzzy Hash: 28218832A01119AFD701DFA98889BFEF7BCDB49719F10416BFA09D6140DB3499418BA2

Function 11117210 Relevance: 12.1, APIs: 8, Instructions: 80windowCOMMON

Download Yara Rule

APIs

SelectPalette.GDI32(?,?,00000000), ref: 1111722F
SelectPalette.GDI32(?,00000000,00000000), ref: 11117245
DeleteObject.GDI32(?), ref: 11117258
DeleteObject.GDI32(?), ref: 11117265
CreatePalette.GDI32(00000000), ref: 1111728B
_free.LIBCMT ref: 111172B2
SelectPalette.GDI32(?,?,00000000), ref: 111172CA
SelectPalette.GDI32(?,?,00000000), ref: 111172E2

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Palette$Select$DeleteObject$Create_free
String ID:
API String ID: 3619949492-0
Opcode ID: 7edd8c45871d9100e56336ed18a4a3365d79fcfa73e38e80b362fc880583a53f
Instruction ID: 26735d4fa86217e7be7900a9e7ab57f52a0ecdf6d6d72ef6a3d455731c52b639
Opcode Fuzzy Hash: 7edd8c45871d9100e56336ed18a4a3365d79fcfa73e38e80b362fc880583a53f
Instruction Fuzzy Hash: A9215C75604B05ABD660DAB5DC88FA7F3EDBB88714F104A29F66AC7240DA31F401CB64

Function 1113F210 Relevance: 12.1, APIs: 8, Instructions: 70windowCOMMON

Download Yara Rule

APIs

GetMenuItemCount.USER32(?), ref: 1113F21B
GetSubMenu.USER32(?,00000000), ref: 1113F238
GetMenuItemID.USER32(?,00000000), ref: 1113F259
GetMenuItemID.USER32(?,00000001), ref: 1113F262
GetMenuItemID.USER32(?,-00000001), ref: 1113F26C
DeleteMenu.USER32(?,00000001,00000400), ref: 1113F282
GetMenuItemID.USER32(?,00000001), ref: 1113F28A
DeleteMenu.USER32(?,-00000001,00000400), ref: 1113F2A1

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$Item$Delete$Count
String ID:
API String ID: 1985338998-0
Opcode ID: db8ccf8eb5a065f9716819879bea2f70c374054ad31006cd5f0d5a6c3e74d67c
Instruction ID: d7b0439ef4bb4b3d793dc2a0426db980467f23fa5905899c816f89088e17e484
Opcode Fuzzy Hash: db8ccf8eb5a065f9716819879bea2f70c374054ad31006cd5f0d5a6c3e74d67c
Instruction Fuzzy Hash: F011AF7A800116FAE7029B60CCC8AAEFB7CEF8526AF008129FA5192048EB70D541C763

Function 110CA720 Relevance: 10.8, APIs: 7, Instructions: 332COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 110CA7D9
GetPropA.USER32(00000000,00000000), ref: 110CA7EA
GetPropA.USER32(?,00000000), ref: 110CA82E
GetPropA.USER32(?), ref: 110CA86F

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Prop$Item
String ID:
API String ID: 2799578624-0
Opcode ID: b51fd9d41760a9475d5060d0a76bd9bb734534f15ddfbc9d5d7ba20a62823a9a
Instruction ID: edfc23d74dfea4f3df903806e27002c84e59e8960ab9ff0472c643c7de85b7e0
Opcode Fuzzy Hash: b51fd9d41760a9475d5060d0a76bd9bb734534f15ddfbc9d5d7ba20a62823a9a
Instruction Fuzzy Hash: 67A10976704115AFD708DE69E890EBF73A9FBC8720B10865AFA46C7281D631EC51DBB0

Function 11022120 Relevance: 10.7, APIs: 4, Strings: 2, Instructions: 241COMMON

Download Yara Rule

APIs

EnableWindow.USER32(00000000,00000001), ref: 110221C8
EnableWindow.USER32(00000000,00000000), ref: 1102221C
wsprintfA.USER32 ref: 110222B5
EnableWindow.USER32(00000000,00000001), ref: 11022412

Strings

m_hWnd, xrefs: 110221B6, 11022209, 11022400
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110221B1, 11022204, 110223FB

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableWindow$wsprintf
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 228105561-2830328467
Opcode ID: e63ebd281dbb963d5325e3dde6966685cec356a3b8d302cc555037c6300c150b
Instruction ID: 44857334acb3210f0bd25458658421543caa90739f7601857ab67cf16656cb78
Opcode Fuzzy Hash: e63ebd281dbb963d5325e3dde6966685cec356a3b8d302cc555037c6300c150b
Instruction Fuzzy Hash: C2A19E35A40219DBEB20DF64CC84FDAF3B5BF55304F5081D9E6599B281D770AA84CF91

Function 11088550 Relevance: 10.7, APIs: 2, Strings: 4, Instructions: 228COMMON

Download Yara Rule

APIs

Part of subcall function 11087840: IsWindow.USER32(?), ref: 1108785F
Part of subcall function 11087840: IsWindow.USER32(?), ref: 1108786D

GetParent.USER32(00000000), ref: 11088596
GetParent.USER32(00000000), ref: 110885A7

Strings

.chm, xrefs: 110886EF, 1108875D
WinHelp cmd=%d, id=%d, file=%s, xrefs: 11088683
debughlp.$$$, xrefs: 110885AF
.hlp, xrefs: 1108870E, 1108873E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ParentWindow
String ID: .chm$.hlp$WinHelp cmd=%d, id=%d, file=%s$debughlp.$$$
API String ID: 3530579756-3361795001
Opcode ID: 1a6ea6b10479e74ffce312823b1cb95a4e065433443d6ed6dc20c9b6873f8aad
Instruction ID: d7bdf8c638d77886c15882aa3625d6552f833178db2238c924cf2fb2c1d74abd
Opcode Fuzzy Hash: 1a6ea6b10479e74ffce312823b1cb95a4e065433443d6ed6dc20c9b6873f8aad
Instruction Fuzzy Hash: 7B712A79E0425AABDB11DF649C80FDEB7F8AF4971CF0040A6ED1997341DA30EA50CBA1

Function 1101B450 Relevance: 10.7, APIs: 3, Strings: 3, Instructions: 204libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 110DC370: EnterCriticalSection.KERNEL32(111E7CDC,11018715,D68DEC44,?,?,?,111838E8,000000FF), ref: 110DC371

std::exception::exception.LIBCMT ref: 1101B696
__CxxThrowException@8.LIBCMT ref: 1101B6B1
LoadLibraryA.KERNEL32(NSSecurity.dll,00000000,111C7B7C), ref: 1101B6CE

Part of subcall function 11008D90: std::_Xinvalid_argument.LIBCPMT ref: 11008DAA

Strings

NSSecurity.dll, xrefs: 1101B6C3
NsAppSystem Info : Control Channel Command Sent : %d, xrefs: 1101B62A
NsAppSystem Info : Control Channel Sending Command : %d, xrefs: 1101B609

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalEnterException@8LibraryLoadSectionThrowXinvalid_argumentstd::_std::exception::exception
String ID: NSSecurity.dll$NsAppSystem Info : Control Channel Command Sent : %d$NsAppSystem Info : Control Channel Sending Command : %d
API String ID: 462760696-1044166025
Opcode ID: 66b1e8bc1a839b22518d9c71a177d91dee4de996896f336eecaa8b14f6792af8
Instruction ID: 4815a9c803ec348cea1f462e622f37205f3cc4ca6df9067b60053abc40c7d179
Opcode Fuzzy Hash: 66b1e8bc1a839b22518d9c71a177d91dee4de996896f336eecaa8b14f6792af8
Instruction Fuzzy Hash: 72717DB5D00309DFEB10CBA4C844BDEFBB4AF05318F54855DE529AB381EB79AA44CB91

Function 110703C0 Relevance: 10.7, APIs: 3, Strings: 4, Instructions: 176COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,D68DEC44,?,?,?), ref: 11070414
LeaveCriticalSection.KERNEL32(?,?,?), ref: 11070428
LeaveCriticalSection.KERNEL32(00000000,?,?,?), ref: 110705A1

Strings

..\ctl32\Connect.cpp, xrefs: 110703F5, 11070500
queue, xrefs: 110703FA
Register NC_CHATEX for conn=%s, q=%p, xrefs: 11070473
r->queue != queue, xrefs: 11070505

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter
String ID: ..\ctl32\Connect.cpp$Register NC_CHATEX for conn=%s, q=%p$queue$r->queue != queue
API String ID: 2978645861-3840833929
Opcode ID: c1ff19ad003b7eb883caaeb5627f5b8d924eebffa39148e37a97584a13f92cb1
Instruction ID: bb5e6513ae91469caa336673269fff567e67103cf0da46c8940af5c1a6ec17bf
Opcode Fuzzy Hash: c1ff19ad003b7eb883caaeb5627f5b8d924eebffa39148e37a97584a13f92cb1
Instruction Fuzzy Hash: 87611AB9E042859FD711CF58C884F9ABBF1FB05314F048799E8999B385EB74E940C794

Function 11141190 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 146COMMON

Download Yara Rule

APIs

GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 111411FD
SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,00000000), ref: 1114123E
SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114129B

Strings

nsmdir < GP_MAX, xrefs: 111411BC
..\ctl32\util.cpp, xrefs: 111411B7, 11141259
FALSE || !"wrong nsmdir", xrefs: 1114125E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$FileModuleName
String ID: ..\ctl32\util.cpp$FALSE || !"wrong nsmdir"$nsmdir < GP_MAX
API String ID: 906376703-1878648853
Opcode ID: d4ffff2fd469ddc1a8d95b92fcbbf17ed1a8ffef79a766b590d4d16e5ffcb488
Instruction ID: 4d31a0fae7798081555cf97c50d8417fff469819868a9eb1fc24d120b90b8c98
Opcode Fuzzy Hash: d4ffff2fd469ddc1a8d95b92fcbbf17ed1a8ffef79a766b590d4d16e5ffcb488
Instruction Fuzzy Hash: 71514775E0462E97DB128F648C50BD9F7A4AB04708F2401E4DC89BB281EB717A85CBA2

Function 110155A0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 128registryCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 1101565A
RegQueryValueExA.ADVAPI32(?,PackedCatalogItem,00000000,?,?,?,?,?,00020019), ref: 110156D8

Strings

%012d, xrefs: 11015654
PackedCatalogItem, xrefs: 110156C2
SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries, xrefs: 110155DB
NSLSP, xrefs: 110156E8

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValuewsprintf
String ID: %012d$NSLSP$PackedCatalogItem$SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\Protocol_Catalog9\Catalog_Entries
API String ID: 2072284396-1346142259
Opcode ID: 41b583e6ded3ad4d1fa63746052bc52f6bbd670a25b51988c27ad70ec553f9b8
Instruction ID: 7267f334a81b803194bb0d31ecadd2f50812faa447e3bebfb52e3e3df59d9c44
Opcode Fuzzy Hash: 41b583e6ded3ad4d1fa63746052bc52f6bbd670a25b51988c27ad70ec553f9b8
Instruction Fuzzy Hash: 07419F75D022699EEB10DB50DC90BEEF7B4EB44314F0441E9E81AA7281EB74AB44CF90

Function 11104780 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 110libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 1110CA00: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000), ref: 1110CA1E

LoadLibraryA.KERNEL32(Wtsapi32.dll,00000000,00000000,11185CA6,000000FF), ref: 11104853
LoadLibraryA.KERNEL32(Advapi32.dll), ref: 111048A2
std::exception::exception.LIBCMT ref: 11104904
__CxxThrowException@8.LIBCMT ref: 11104919

Strings

Advapi32.dll, xrefs: 11104855
Wtsapi32.dll, xrefs: 1110484E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$CreateEventException@8Throwstd::exception::exception
String ID: Advapi32.dll$Wtsapi32.dll
API String ID: 3471813348-2390547818
Opcode ID: 41a0cd7cd49d0357425b44292a2eb0744fb4b7e1fedd48645a50bd7aed42965a
Instruction ID: b5ec286250cf981fce2a0e6d3e96e32b54e298f52b43839d713f200b5280be45
Opcode Fuzzy Hash: 41a0cd7cd49d0357425b44292a2eb0744fb4b7e1fedd48645a50bd7aed42965a
Instruction Fuzzy Hash: 5D4103B4C09B449EC761CF6A8980BDAFBE8EFA5604F10494ED5AE93210D7787500CF61

Function 1102A330 Relevance: 10.6, APIs: 1, Strings: 5, Instructions: 105COMMON

Download Yara Rule

APIs

GetComputerNameA.KERNEL32(?,?), ref: 1102A44D

Strings

*channel, xrefs: 1102A38B
Client, xrefs: 1102A390
e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 1102A3DC, 1102A412
IsA(), xrefs: 1102A3E1, 1102A417
, xrefs: 1102A446

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ComputerName
String ID: $*channel$Client$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 3545744682-214531959
Opcode ID: 494dc6c809ad68f41ce9554c000fec6f3eb41f359cd9eacb04185840408dd0cc
Instruction ID: afd0a7df2d94467ee977813eae6db71dc6cde903e66e06d390c03baf8244eb4f
Opcode Fuzzy Hash: 494dc6c809ad68f41ce9554c000fec6f3eb41f359cd9eacb04185840408dd0cc
Instruction Fuzzy Hash: EA410274E0065ADEDB10CFE8C894BDDFBF5BF48308F508159E529AB280DB746945CB91

Function 1101D660 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 100registryCOMMON

Download Yara Rule

APIs

GetClassInfoExA.USER32(00000000,NSMChatSizeWnd,?), ref: 1101D6AA
RegisterClassExA.USER32(?), ref: 1101D6FB
CreateWindowExA.USER32(00000000,NSMChatSizeWnd,11190210,00CF0000,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 1101D72E
GetWindowRect.USER32(00000000,?), ref: 1101D73B
DestroyWindow.USER32(00000000), ref: 1101D742

Strings

NSMChatSizeWnd, xrefs: 1101D69C, 1101D6F1, 1101D728

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Class$CreateDestroyInfoRectRegister
String ID: NSMChatSizeWnd
API String ID: 691703853-4119039562
Opcode ID: 5db015d3e46b3fed72b5eb7fff4cef691deec8ee1839ee1fd58d571383644140
Instruction ID: 626a1dab15bc1ab6d6b5a05782c7b2f828b0f6c46e54969ea9da4fdeefd75d5e
Opcode Fuzzy Hash: 5db015d3e46b3fed72b5eb7fff4cef691deec8ee1839ee1fd58d571383644140
Instruction Fuzzy Hash: 52315CB5D0121EAFDB10DFA5DDC4BEEF7B8FB48218F20452EE919A6240E6356901CB61

Function 11004060 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 91windowCOMMON

Download Yara Rule

APIs

EnableWindow.USER32(00000000,00000000), ref: 110040A0
BitBlt.GDI32(00000000,00000000,00000000,?,?,?,00000000,00000000,00CC0020), ref: 11004117
InvalidateRect.USER32(00000000,00000000,00000000), ref: 11004142
EnableWindow.USER32(00000000,00000001), ref: 1100416E

Strings

m_hWnd, xrefs: 11004087, 1100412D, 1100415B
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11004082, 11004128, 11004156

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableWindow$InvalidateRect
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1143196926-2830328467
Opcode ID: a15a01fb390b56b7d77f6e9785fdaaf2784d5151a1249e3df42ba4287bbf74d0
Instruction ID: d4a70cfb85932fb2c0135b529b30871e1662328d43eb4d1d0fb241fa065f98d1
Opcode Fuzzy Hash: a15a01fb390b56b7d77f6e9785fdaaf2784d5151a1249e3df42ba4287bbf74d0
Instruction Fuzzy Hash: AC31A075B40709ABE320DF55CC45F9AF3F9AF88704F118568E65AA76C0D7B0F8408B94

Function 110B7650 Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 110B7682
GetSystemMetrics.USER32(0000004D), ref: 110B7689
GetSystemMetrics.USER32(0000004E), ref: 110B7690
GetSystemMetrics.USER32(0000004F), ref: 110B7697
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 110B76A6
GetSystemMetrics.USER32(?), ref: 110B76B4
GetSystemMetrics.USER32(00000001), ref: 110B76C3

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: System$Metrics$InfoParameters
String ID:
API String ID: 3136151823-0
Opcode ID: 753694760e88539a25b01a14926e9b1a76e16f057b709901493451a658f4cbee
Instruction ID: f341f48804fb158a3087ea2b2bbce83e063b4f4fbb83f8af507c1d165cb1a27d
Opcode Fuzzy Hash: 753694760e88539a25b01a14926e9b1a76e16f057b709901493451a658f4cbee
Instruction Fuzzy Hash: 4C310975E0070A9FCB14DFA9C981AAEFBF1AF88714F14842AE519E7380D674A840CF58

Function 1109C4E0 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 78sleepCOMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 1109C4FF
GetClassNameA.USER32(?,?,00000040), ref: 1109C510
FindWindowA.USER32(?,00000000), ref: 1109C551
Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,1109CC40,D68DEC44,1106FA4F,?,11065196,00000000), ref: 1109C56C
FindWindowA.USER32(?,00000000), ref: 1109C57D

Strings

gfff, xrefs: 1109C52A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Find$ClassNameSleep
String ID: gfff
API String ID: 1867012073-1553575800
Opcode ID: 00999eb0a2f0bf2e2c186a4b7a4f6fc08334bcab875262ccf13a71b660ca9f2e
Instruction ID: 919be8c2fd41255be5736ed824c612855c6c8bfcdeededc0e6f8312de4f005b5
Opcode Fuzzy Hash: 00999eb0a2f0bf2e2c186a4b7a4f6fc08334bcab875262ccf13a71b660ca9f2e
Instruction Fuzzy Hash: DE21F672E0162E5BD701DEA4C984A9EFBE8FF48710F454125F905E7344EB30E942DBA1

Function 110095E0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 77fileCOMMON

Download Yara Rule

APIs

Part of subcall function 110CEEA0: wvsprintfA.USER32(?,11190210,?), ref: 110CEED2

WriteFile.KERNEL32(00000000,?,?,00000000,00000000), ref: 11009696
WriteFile.KERNEL32(?,<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >,000000B9,00000000,00000000), ref: 110096AB

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h, xrefs: 11009648, 11009670
<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >, xrefs: 110096A5
IsA(), xrefs: 1100964D, 11009675
<HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">, xrefs: 11009619

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FileWrite$wvsprintf
String ID: <HTML%s><Body><title>Approved URLs</title><body bgcolor="#FFFFFF"><div align="center"> <center><table > <td><div align="center"> <center><table border="1" cellspacing="0" cellpadding="3" bgcolor="#FFFFFF" bordercolor="#6089B7">$<tr><td ><div align="center"><img src="URL_list.gif" height="78"><br></div> </td></tr><tr><td > <div align="left"> <table border="0" cellpadding="0" height="23" >$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\NSMString.h
API String ID: 668965605-389219706
Opcode ID: 35c9443653c76611831565fc59710334538614d37e03491763d50dcb95985eb9
Instruction ID: f06608e0f0d79a33ff7b3cc36c6320de286f4daff1cda15a21bef47ad452120e
Opcode Fuzzy Hash: 35c9443653c76611831565fc59710334538614d37e03491763d50dcb95985eb9
Instruction Fuzzy Hash: 52214C79A00519ABDB00DB95CC51FDEF3B8AF89614F104659E921B3280EB747904CBA1

Function 1115F152 Relevance: 10.6, APIs: 7, Instructions: 74COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32(?,0000000F,00000000,?,?,1115F256,?,111D6D40,0000000C,1115F282,?,?,11019D01,1118BD10,MESSAGE,00000007), ref: 1115F167
DecodePointer.KERNEL32(?,0000000F,00000000,?,?,1115F256,?,111D6D40,0000000C,1115F282,?,?,11019D01,1118BD10,MESSAGE,00000007), ref: 1115F174
__realloc_crt.LIBCMT ref: 1115F1B1
__realloc_crt.LIBCMT ref: 1115F1C7
EncodePointer.KERNEL32(00000000,?,0000000F,00000000,?,?,1115F256,?,111D6D40,0000000C,1115F282,?,?,11019D01,1118BD10,MESSAGE), ref: 1115F1D9
EncodePointer.KERNEL32(?,?,0000000F,00000000,?,?,1115F256,?,111D6D40,0000000C,1115F282,?,?,11019D01,1118BD10,MESSAGE), ref: 1115F1ED
EncodePointer.KERNEL32(-00000004,?,0000000F,00000000,?,?,1115F256,?,111D6D40,0000000C,1115F282,?,?,11019D01,1118BD10,MESSAGE), ref: 1115F1F5

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Pointer$Encode$Decode__realloc_crt
String ID:
API String ID: 4108716018-0
Opcode ID: b81318e0c4676aee76517b9ded476b67b900e6d78b1b3f79e2cbe89251de18ea
Instruction ID: 1036eac50b9dbc2edeacdc4050650fe2a548538fccac5fd7c48e958f603690b7
Opcode Fuzzy Hash: b81318e0c4676aee76517b9ded476b67b900e6d78b1b3f79e2cbe89251de18ea
Instruction Fuzzy Hash: EB119A76600127AFDB416FA5DCC085FFBEEEB42268311443AD925E7150E772ED50CB51

Function 1100E150 Relevance: 10.6, APIs: 7, Instructions: 64COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 1100E174

Part of subcall function 1115E951: RaiseException.KERNEL32(111580BE,111CF564,00000000,?,111580BE,111CF564,?,11157D7B,00000000,?,111580BE,?), ref: 1115E993

std::exception::exception.LIBCMT ref: 1100E198
__CxxThrowException@8.LIBCMT ref: 1100E1B3
std::exception::exception.LIBCMT ref: 1100E1D2
__CxxThrowException@8.LIBCMT ref: 1100E1ED
std::exception::exception.LIBCMT ref: 1100E207
__CxxThrowException@8.LIBCMT ref: 1100E222

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$std::exception::exception$ExceptionRaise
String ID:
API String ID: 4237746311-0
Opcode ID: 52ab906eb77a9652387295bce8dcb833e4dc17af1317a8630217c36142451add
Instruction ID: 6aae388e393be818eb3e487128fda81968f03a1331bac65208d3b1bb8155b547
Opcode Fuzzy Hash: 52ab906eb77a9652387295bce8dcb833e4dc17af1317a8630217c36142451add
Instruction Fuzzy Hash: BA2156B5C0121EAADB80DF95C540BDEFBF8AF54754F60C04EE526B7240EA746B40CB62

Function 1101E550 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 62COMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 1101E574
FindWindowExA.USER32(00000000,00000000,SHELLDLL_DefView,00000000), ref: 1101E584
GetWindowLongA.USER32(00000000,000000FC), ref: 1101E58F
SetWindowLongA.USER32(00000000,000000FC,Function_0001E4F0), ref: 1101E5BE
SetWindowLongA.USER32(00000000,000000FC,00000000), ref: 1101E5E2

Strings

SHELLDLL_DefView, xrefs: 1101E57C

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window$Long$FindParent
String ID: SHELLDLL_DefView
API String ID: 3423459710-137347452
Opcode ID: 16186df46e2150dafe9b948ead40d3fd3a4b02e042ce9daa1d5a0f3bb963346c
Instruction ID: f5bb17470cfd427ffda648c77ede3731efb588e0423bb9dcac961717e870c067
Opcode Fuzzy Hash: 16186df46e2150dafe9b948ead40d3fd3a4b02e042ce9daa1d5a0f3bb963346c
Instruction Fuzzy Hash: 4811C471D011326BE7079EB88998A6DBBD8E740738F114666FE32CB18CFE2889504790

Function 110055E0 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 62windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(00000000,?), ref: 1100561D
BeginPaint.USER32(?,?), ref: 11005628
BitBlt.GDI32(00000000,00000000,00000000,?,00000000,?,00000000,00000000,00CC0020), ref: 1100564A
EndPaint.USER32(?,?), ref: 1100566F

Strings

m_hWnd, xrefs: 11005608
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11005603

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Paint$BeginClientRect
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1423913981-2830328467
Opcode ID: 4629c74a4cd1d84fe9771c779d4a6cd9091568d14897290379628446527798fe
Instruction ID: 07d059ef89c98bac88b63ca25d5df13e5fa06068b80759bc46276380e995db9a
Opcode Fuzzy Hash: 4629c74a4cd1d84fe9771c779d4a6cd9091568d14897290379628446527798fe
Instruction Fuzzy Hash: 2E114C75A00219BFE711DBA0CC85FAEF3BCEB88744F108569F616A6180EA71B9048B65

Function 110020F0 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 60COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 11002194
SetCursor.USER32(00000000), ref: 1100219B

Strings

Rh,, xrefs: 11002162
RW,, xrefs: 11002173
RF,, xrefs: 11002184
Ry,, xrefs: 11002151

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$Load
String ID: RF,$RW,$Rh,$Ry,
API String ID: 1675784387-949026458
Opcode ID: 2078037fcad6ab8a313a190f3ceb760dda9fb663c1f9ba592cc656f5dc363d1e
Instruction ID: e024c4776f8bf4b643dedb200ffdb8700e817e4a9316ea64be199e62634f8550
Opcode Fuzzy Hash: 2078037fcad6ab8a313a190f3ceb760dda9fb663c1f9ba592cc656f5dc363d1e
Instruction Fuzzy Hash: B711C8BCD081E6A6E305D6649D94F7E326C87D538DF008C21FA85C9AC4D939E851F274

Function 1100B2A0 Relevance: 10.6, APIs: 7, Instructions: 54COMMON

Download Yara Rule

APIs

InterlockedDecrement.KERNEL32(?), ref: 1100B2B0
EnterCriticalSection.KERNEL32(?), ref: 1100B2E9
EnterCriticalSection.KERNEL32(?), ref: 1100B308

Part of subcall function 1100A210: CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,?,?,?,?,?,?,1100D500,?,FEFE000F), ref: 1100A22E
Part of subcall function 1100A210: DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A258
Part of subcall function 1100A210: GetLastError.KERNEL32(?,?,?,?,?,?,?,1100D500,?,FEFE000F), ref: 1100A260
Part of subcall function 1100A210: WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,1100D500,?,FEFE000F), ref: 1100A274
Part of subcall function 1100A210: CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,1100D500,?,FEFE000F), ref: 1100A27B

waveOutUnprepareHeader.WINMM(00000000,?,00000020), ref: 1100B318
LeaveCriticalSection.KERNEL32(?), ref: 1100B31F
_free.LIBCMT ref: 1100B328
_free.LIBCMT ref: 1100B32E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Enter_free$CloseControlCreateDecrementDeviceErrorEventHandleHeaderInterlockedLastLeaveObjectSingleUnprepareWaitwave
String ID:
API String ID: 705253285-0
Opcode ID: e0e51f26b264bdae045ea75ff578cf94a2673bacf755684c43c5028159ba19d1
Instruction ID: ad56d56a98de85cebacc480540f5adc7982b501aa6d0a237bb23d5c915e331fd
Opcode Fuzzy Hash: e0e51f26b264bdae045ea75ff578cf94a2673bacf755684c43c5028159ba19d1
Instruction Fuzzy Hash: 23118279900715ABE711DF60DC88BEFB3ECAB49359F108529FA6692140D7707641CB62

Function 1110C790 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 52synchronizationthreadCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,11001763,00000000,00000001,00000000), ref: 1110C7A7
CreateThread.KERNEL32(00000000,11001763,00000001,?,00000000,00000001), ref: 1110C7CA
WaitForSingleObject.KERNEL32(?,000000FF,?,?,?,?,11001763,00000000,00000001,00000000), ref: 1110C7F7
CloseHandle.KERNEL32(?,?,?,?,?,11001763,00000000,00000001,00000000), ref: 1110C801

Strings

..\ctl32\Refcount.cpp, xrefs: 1110C7DB
hThread, xrefs: 1110C7E0

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Create$CloseEventHandleObjectSingleThreadWait
String ID: ..\ctl32\Refcount.cpp$hThread
API String ID: 3360349984-1136101629
Opcode ID: 031175a7cafa06ab11b966712e7977785167b2c97c8e915af22cced2550632cf
Instruction ID: 285d9552600945061255d36a29bfbc7aa16c61811fb9a7401ba9aa56dbac6864
Opcode Fuzzy Hash: 031175a7cafa06ab11b966712e7977785167b2c97c8e915af22cced2550632cf
Instruction Fuzzy Hash: 8B0184767407126FE3218F55CC89F5BBBA8EB44765F108229FB15D72C0D6B0E8048B64

Function 11003300 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EFD), ref: 1100330D
GetSubMenu.USER32(00000000,00000000), ref: 11003333
DestroyMenu.USER32(00000000), ref: 11003362

Strings

hSub, xrefs: 11003349
..\CTL32\annotate.cpp, xrefs: 1100331E, 11003344
hMenu, xrefs: 11003323

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyLoad
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 588275208-934300333
Opcode ID: 501d3bcbbce18d7af65b4f5c9cae6a7cf719a26558655655dbc6ccb73199cbae
Instruction ID: fa32570248bed0a6ee28765b532c77738246b772a435558003de1ca55720cc18
Opcode Fuzzy Hash: 501d3bcbbce18d7af65b4f5c9cae6a7cf719a26558655655dbc6ccb73199cbae
Instruction Fuzzy Hash: 7EF0A77EF5057266D31361A53C09F8FB7484BC15ACF164071F910EA680EA20A40181F6

Function 110033F0 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 35windowCOMMON

Download Yara Rule

APIs

LoadMenuA.USER32(00000000,00002EF1), ref: 110033FD
GetSubMenu.USER32(00000000,00000000), ref: 11003423
DestroyMenu.USER32(00000000), ref: 11003452

Strings

hSub, xrefs: 11003439
..\CTL32\annotate.cpp, xrefs: 1100340E, 11003434
hMenu, xrefs: 11003413

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu$DestroyLoad
String ID: ..\CTL32\annotate.cpp$hMenu$hSub
API String ID: 588275208-934300333
Opcode ID: 9469ff0b1b919e586b560aa23d716be103c2be9006504965fb9a18d7c786e67b
Instruction ID: 71a9ea70e180e0bb601fc7aaa6bc9f1f9c31c8fcf93da2728ba3530c72dc20f3
Opcode Fuzzy Hash: 9469ff0b1b919e586b560aa23d716be103c2be9006504965fb9a18d7c786e67b
Instruction Fuzzy Hash: FFF0A07EF4066267D31362A97C09F8FBA488BC19ECF174071F914BE681E920B40181F6

Function 1102938C Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 31windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110293A7
MessageBoxA.USER32(00000000,?,Client32,00000000), ref: 110293E3
ExitProcess.KERNEL32 ref: 110293F9

Strings

Client32, xrefs: 110293D5
Assert failed, file %hs, line %d, error code %dBuild: %hsExpression: %s, xrefs: 110293A1
V12.10F1, xrefs: 11029393

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitMessageProcesswsprintf
String ID: Assert failed, file %hs, line %d, error code %dBuild: %hsExpression: %s$Client32$V12.10F1
API String ID: 1070390611-3175581428
Opcode ID: 5f8afb6781fff8d20e36d48c55478ddb8376a63a2f05363f3c6827cb3b43e1d7
Instruction ID: 69fd2f0e93a38133f3dd709aa807cf70f57901cb3e0238c7135cfe5ab5aa075d
Opcode Fuzzy Hash: 5f8afb6781fff8d20e36d48c55478ddb8376a63a2f05363f3c6827cb3b43e1d7
Instruction Fuzzy Hash: AFF027BAA00125AFE706DFE4DCD9FBDB66CEB5430DF004029F212D1080E6B45A80CB32

Function 1111F250 Relevance: 9.2, APIs: 6, Instructions: 248COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1111F2B6

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick
String ID:
API String ID: 536389180-0
Opcode ID: 8ea1c1560f7788a6908fe167d57f388c349290c83936e0db87a5b618e34c8661
Instruction ID: e1edf0d0eea8b6a26a149b11e6a49180b9075abd814c9dc64c89d1e4f129e258
Opcode Fuzzy Hash: 8ea1c1560f7788a6908fe167d57f388c349290c83936e0db87a5b618e34c8661
Instruction Fuzzy Hash: 5691AF7590420B8BDB10CF74C4847EEF7F4EF54318F10463AD85A9B284D775AA4ACB92

Function 110315E0 Relevance: 9.2, APIs: 6, Instructions: 156fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000), ref: 11031634
GetFileSize.KERNEL32(00000000,00000000), ref: 11031650
ReadFile.KERNEL32(?,00000000,?,?,00000000), ref: 11031673
_memmove.LIBCMT ref: 110316C7
CloseHandle.KERNEL32(?), ref: 11031703
CloseHandle.KERNEL32(?), ref: 11031764

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: File$CloseHandle$CreateReadSize_memmove
String ID:
API String ID: 3732248721-0
Opcode ID: 7a927c8a09ccdb950cc3433614be4b2dad5d6a74fada9858701b4b7e42e838d8
Instruction ID: 584aca9e48e6313ea9016492053d8a6c1670f343e919f333d09e91d9dd94188c
Opcode Fuzzy Hash: 7a927c8a09ccdb950cc3433614be4b2dad5d6a74fada9858701b4b7e42e838d8
Instruction Fuzzy Hash: 40513CB5E01218AFCB40DFB8D884A9EFBF9BF48314F14852AE515E7241E731A905CBA1

Function 11016400 Relevance: 9.1, APIs: 6, Instructions: 80windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,0000007F,00000000,00000000,00000002,000001F4,?), ref: 11016432
GetClassLongA.USER32(?), ref: 1101644E
CopyIcon.USER32(00000000), ref: 11016459
SendMessageTimeoutA.USER32(?,0000007F,00000001,00000000,00000002,000001F4,00000000), ref: 1101647F
GetClassLongA.USER32(?,000000F2), ref: 1101648F
CopyImage.USER32(00000000,00000001,?,?,00000000), ref: 110164A9

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassCopyLongMessageSendTimeout$IconImage
String ID:
API String ID: 1346719093-0
Opcode ID: e077314548e86336898ff6eee9e8d73a2cc4d5d68bd0cc21af1a292f93e34cb2
Instruction ID: 9f004cfda12990e9d3370ddacbcdde7cd046756d09ccd38f7e5ba6b1f386c4fa
Opcode Fuzzy Hash: e077314548e86336898ff6eee9e8d73a2cc4d5d68bd0cc21af1a292f93e34cb2
Instruction Fuzzy Hash: C7110AB1B91225B7FB048A69CC46FFEB39CDF45761F108265F624EA1C4EAF499004760

Function 11143670 Relevance: 9.0, APIs: 6, Instructions: 48threadsynchronizationCOMMON

Download Yara Rule

APIs

OpenThread.KERNEL32(0000004A,00000000,111437D8,?,?,?,?,?,111437D8), ref: 1114369A
CreateThread.KERNEL32(00000000,00001000,11143610,?,00000000,?), ref: 111436BE
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,111437D8), ref: 111436C9
GetExitCodeThread.KERNEL32(00000000,00000000,?,?,?,?,?,?,111437D8), ref: 111436D4
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,111437D8), ref: 111436E1
CloseHandle.KERNEL32(?,?,?,?,?,?,?,111437D8), ref: 111436E7

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Thread$CloseHandle$CodeCreateExitObjectOpenSingleWait
String ID:
API String ID: 180989782-0
Opcode ID: 6e989606e389677d7464659de08a3843fc544abd0f8b28c828e11cd3f0aaa32a
Instruction ID: d8cd404a83e23fe40b10f029509bdbdf3f0c56d1a485a15e6698da08aed2c591
Opcode Fuzzy Hash: 6e989606e389677d7464659de08a3843fc544abd0f8b28c828e11cd3f0aaa32a
Instruction Fuzzy Hash: 6401DE71D0422AAFDB01DF98CC45BEEBBB8EF48711F108165FA24E7284D7749A018BA5

Function 11002500 Relevance: 9.0, APIs: 6, Instructions: 46COMMON

Download Yara Rule

APIs

SetROP2.GDI32(?,00000007), ref: 11002515
SelectObject.GDI32(?,?), ref: 11002522
MoveToEx.GDI32(?,?,?,00000000), ref: 11002538
LineTo.GDI32(?,?,?), ref: 11002547
SelectObject.GDI32(?,?), ref: 11002552
SetROP2.GDI32(?,?), ref: 1100255D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ObjectSelect$LineMove
String ID:
API String ID: 359220273-0
Opcode ID: 854bd7ae709968c79ae30127d0822c48ccb55bc78ccd4d7f325eae93945e0193
Instruction ID: a0c4cf8148719bcdc610b23f955ae68f9ffb5dac02a0ff51bd87c75a84a8d7f3
Opcode Fuzzy Hash: 854bd7ae709968c79ae30127d0822c48ccb55bc78ccd4d7f325eae93945e0193
Instruction Fuzzy Hash: 3C01E47A611526BFD705DB99CC88DAEF7ADFF89314B10811AFA1893200D770EE118BA5

Function 110943C0 Relevance: 9.0, APIs: 6, Instructions: 38COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000004C), ref: 110943CE
GetSystemMetrics.USER32(0000004D), ref: 110943D7
GetSystemMetrics.USER32(0000004E), ref: 110943DE
GetSystemMetrics.USER32(00000000), ref: 110943E7
GetSystemMetrics.USER32(0000004F), ref: 110943ED
GetSystemMetrics.USER32(00000001), ref: 110943F5

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem
String ID:
API String ID: 4116985748-0
Opcode ID: 11db67ba4494b8ab037b4ede978d8297e820abd6079b90c954c2efc898489588
Instruction ID: 7e0453e0d3d140f4b47b4606fc30701750c5ac0c5c89a497b26d9bada1891703
Opcode Fuzzy Hash: 11db67ba4494b8ab037b4ede978d8297e820abd6079b90c954c2efc898489588
Instruction Fuzzy Hash: 5BF030B1B4131A6BE7009BA99C81B56BB98EB48654F00C037A71CC7240DAB4A8108BE4

Function 1101F390 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 151COMMON

Download Yara Rule

APIs

Part of subcall function 11141190: GetModuleFileNameA.KERNEL32(00000000,?,00000104,00000000), ref: 111411FD
Part of subcall function 11141190: SHGetFolderPathA.SHFOLDER(00000000,00000026,00000000,00000000,?,00000000), ref: 1114123E
Part of subcall function 11141190: SHGetFolderPathA.SHFOLDER(00000000,0000001A,00000000,00000000,?), ref: 1114129B

SHGetFolderPathA.SHFOLDER(00000000,00000005,00000000,00000000,00000000), ref: 1101F515
GetSaveFileNameA.COMDLG32(?), ref: 1101F537
_fputs.LIBCMT ref: 1101F563

Strings

ChatPath, xrefs: 1101F4F1
X, xrefs: 1101F411

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FolderPath$FileName$ModuleSave_fputs
String ID: ChatPath$X
API String ID: 2674625905-3955712077
Opcode ID: 5d3865f711a4aff83900321e3dee246bd8cc29ad915e8c5e729656da6a5ac854
Instruction ID: 50eb5ec30d5d4bf6829388f3de2c627c1bd4d9f551a02557368182b96dc304e2
Opcode Fuzzy Hash: 5d3865f711a4aff83900321e3dee246bd8cc29ad915e8c5e729656da6a5ac854
Instruction Fuzzy Hash: 1351CF75E043299FEB21DF60CC44B9ABBB4BF45708F1046D9D9086B280EB75EA84CF91

Function 110873C0 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 128COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?,1117CB84,D68DEC44,1117CB84,?,1104032D,00000000,1117EB38,000000FF,?,11086E1A,00000001,?,1104032D), ref: 11087430
_sprintf.LIBCMT ref: 110874CE
LeaveCriticalSection.KERNEL32(?), ref: 110874DA
LeaveCriticalSection.KERNEL32(00000000,?,11086E1A,00000001,?,1104032D), ref: 11087513

Strings

Unable to allocate memory for key[%d] '%s', xrefs: 110874BF

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$Leave$Enter_sprintf
String ID: Unable to allocate memory for key[%d] '%s'
API String ID: 273088606-3198095033
Opcode ID: 15a78dae96c25c1249d4355511e4fa726ea1d12827e633c8eb1b14df315da0eb
Instruction ID: 18ce0c57ec18a214d4be5223c16706c0a5b428ba6594b5e746d7c1e3405cdd68
Opcode Fuzzy Hash: 15a78dae96c25c1249d4355511e4fa726ea1d12827e633c8eb1b14df315da0eb
Instruction Fuzzy Hash: 6841A275E04A469FD705CF58D880BAAFBE9FF88304F108669E859C7345DB71E820CBA0

Function 11033610 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 125windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00000146,00000000,00000000), ref: 11033663
SendMessageA.USER32(?,00000149,00000000,00000000), ref: 11033689
SendMessageA.USER32(?,00000148,00000000,?), ref: 110336AD
_strncmp.LIBCMT ref: 11033712

Strings

ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&')(.-_{}~., xrefs: 11033645

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$_strncmp
String ID: ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789!@#$%^&')(.-_{}~.
API String ID: 3653864897-2723064302
Opcode ID: b6e3913fd897f0dc63d299ad0ec45806af9018daef9e496465516e1d3d3684dc
Instruction ID: 5b03eaf72942329d6c579f24eb0f3a7bc05508738fae8b1ad7e18b0185d70ad6
Opcode Fuzzy Hash: b6e3913fd897f0dc63d299ad0ec45806af9018daef9e496465516e1d3d3684dc
Instruction Fuzzy Hash: 68415B75E146595FC712CF388CD0BFAB7E9AF85316F1482D4E818DF390D6319A488B40

Function 110DC1B0 Relevance: 8.9, APIs: 2, Strings: 3, Instructions: 106COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 110DC2A4
__CxxThrowException@8.LIBCMT ref: 110DC2B9

Part of subcall function 11009230: std::_Xinvalid_argument.LIBCPMT ref: 110092A5
Part of subcall function 11009230: _memmove.LIBCMT ref: 110092F6

Strings

The version of the software you are running is not supported by the service, xrefs: 110DC256
Invalid Passcode, xrefs: 110DC235
Your system/device requires approval by the service before you can access it fully, xrefs: 110DC277

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8ThrowXinvalid_argument_memmovestd::_std::exception::exception
String ID: Invalid Passcode$The version of the software you are running is not supported by the service$Your system/device requires approval by the service before you can access it fully
API String ID: 22950630-299493402
Opcode ID: 30d743c850c6e698dcb13e0a79c5bea5c8ce2404627df4534606090f66cd9a48
Instruction ID: e0ec0f5375d888de95cd7de74b0f907f371b2627be3a87ec1a117b8ec04c684f
Opcode Fuzzy Hash: 30d743c850c6e698dcb13e0a79c5bea5c8ce2404627df4534606090f66cd9a48
Instruction Fuzzy Hash: CD4184B590470AAFDB00CF95C840B9EFBF8FB44314F00865EE519A7680EB75B604CBA0

Function 110EB600 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 101registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?,00000000,00000000,001D9C8A), ref: 110EB651
_free.LIBCMT ref: 110EB66C

Part of subcall function 1115EF45: HeapFree.KERNEL32(00000000,00000000,?,11167B06,00000000,?,1110C98E,?,?,?,?,111415F2,?,?,?), ref: 1115EF5B
Part of subcall function 1115EF45: GetLastError.KERNEL32(00000000,?,11167B06,00000000,?,1110C98E,?,?,?,?,111415F2,?,?,?), ref: 1115EF6D

RegQueryValueExA.ADVAPI32(000007FF,?,00000000,?,00000000,000007FF), ref: 110EB6AA
_free.LIBCMT ref: 110EB733

Strings

Error %d getting %s, xrefs: 110EB6ED

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValue_free$ErrorFreeHeapLast
String ID: Error %d getting %s
API String ID: 3888477750-2709163689
Opcode ID: 74974154b0f78acf9a9386200a328a5d55b731fc0091cc20940167a9dba8ba97
Instruction ID: 4fb168a65fe351acaf7c486ccb464f0dcd97330c6e7b3813b7e71d7efdd69b2e
Opcode Fuzzy Hash: 74974154b0f78acf9a9386200a328a5d55b731fc0091cc20940167a9dba8ba97
Instruction Fuzzy Hash: 53318175D011289BDB90DB54CC84BAEB7F9BF45704F04C0E9E889A7240DE306E898FE1

Function 1109C5B0 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 91windowthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageA.USER32(110269C5,752BF08B,68575608,11194E64), ref: 1109C626
SendMessageA.USER32(00000000,752BF08B,68575608,11194E64), ref: 1109C65F

Part of subcall function 1109C4E0: IsWindow.USER32(?), ref: 1109C4FF
Part of subcall function 1109C4E0: GetClassNameA.USER32(?,?,00000040), ref: 1109C510
Part of subcall function 1109C4E0: FindWindowA.USER32(?,00000000), ref: 1109C551
Part of subcall function 1109C4E0: Sleep.KERNEL32(?,?,?,?,?,?,?,?,?,?,1109CC40,D68DEC44,1106FA4F,?,11065196,00000000), ref: 1109C56C
Part of subcall function 1109C4E0: FindWindowA.USER32(?,00000000), ref: 1109C57D

PostMessageA.USER32(00000000,752BF08B,68575608,11194E64), ref: 1109C67B

Strings

m_cds.cbData < m_pSharedHeader->dwDataLen - sizeof(IPCData), xrefs: 1109C602
..\CTL32\ipc.cpp, xrefs: 1109C5FD

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$FindPost$ClassNameSendSleepThread
String ID: ..\CTL32\ipc.cpp$m_cds.cbData < m_pSharedHeader->dwDataLen - sizeof(IPCData)
API String ID: 3524374798-1411620790
Opcode ID: bab0e9056f0d126aef192db4a1277e7fa9bd18f1ca6621b364df7b4299b2a23b
Instruction ID: a273d0ee924d546145a8a3fed0265c5fb073f351777cf119f53b0ef2fd959a09
Opcode Fuzzy Hash: bab0e9056f0d126aef192db4a1277e7fa9bd18f1ca6621b364df7b4299b2a23b
Instruction Fuzzy Hash: 54219676B00606AFD314CF19D990DA7F3E9FB89365B10862AE55A87A40D730FC51DBA0

Function 11060750 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 90COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11060773

Strings

..\CTL32\configplus.cpp, xrefs: 11060818
result <= buflen, xrefs: 1106081D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: ..\CTL32\configplus.cpp$result <= buflen
API String ID: 2111968516-413741496
Opcode ID: 3de2081b53cb75f78539c2c90df1c0939cc826975714fe9aa950efc47e9fc757
Instruction ID: 947d8c2857cc2d43c56bf2ba0b3aaab6ed7787161be8f39afd7ff80778453c50
Opcode Fuzzy Hash: 3de2081b53cb75f78539c2c90df1c0939cc826975714fe9aa950efc47e9fc757
Instruction Fuzzy Hash: F521E235E40156ABC301CE289C84DEEB3EEAF85228B14C6A1FDA597288E635E904C7D1

Function 11088030 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 75COMMON

Download Yara Rule

APIs

FindResourceA.KERNEL32(00000000,00001770,0000000A), ref: 1108806F
LoadResource.KERNEL32(00000000,00000000,?,00000000,?,110CCBB0,?,?,?,?,?,11181FCB,000000FF,?,11016756,?), ref: 11088084
LockResource.KERNEL32(00000000,?,00000000,?,110CCBB0,?,?,?,?,?,11181FCB,000000FF,?,11016756,?,D68DEC44), ref: 110880B6

Strings

hMap, xrefs: 1108809D
..\ctl32\Errorhan.cpp, xrefs: 11088098, 110880C7

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Resource$FindLoadLock
String ID: ..\ctl32\Errorhan.cpp$hMap
API String ID: 2752051264-327499879
Opcode ID: 9e564998d1addb9f42661e2531cecb992941520b0077e94ea4e276c809040fc9
Instruction ID: 36d97cfcc88849806b5f780e5a9390788782ad16e068f94c7388d1ba591faaf1
Opcode Fuzzy Hash: 9e564998d1addb9f42661e2531cecb992941520b0077e94ea4e276c809040fc9
Instruction Fuzzy Hash: 82110A3AF0526766D752EAA5BC4077AB6E89B8079CB054076FD5CE3180FB34D540C7A2

Function 1115C1C0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 70registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(80000000,CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32,00000000,00020019,?,?), ref: 1115C1F8
RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?,?), ref: 1115C239
ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 1115C25D
RegCloseKey.ADVAPI32(?), ref: 1115C28A

Strings

CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32, xrefs: 1115C1EE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseEnvironmentExpandOpenQueryStringsValue
String ID: CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32
API String ID: 1800380464-4062393554
Opcode ID: c078594b20246961fdb1407474ecc1fecfee7b3a41e4a1eff5fd4ab98162d4c3
Instruction ID: e7fed0f6d03d3d9b18bdf511cffda3246d39eace44bf22a9e30bd518b143c6e5
Opcode Fuzzy Hash: c078594b20246961fdb1407474ecc1fecfee7b3a41e4a1eff5fd4ab98162d4c3
Instruction Fuzzy Hash: AC212171A0012DAFDBA59F65CC45BDFFBBCEB06744F0042A6E619E2140DA705A94CF91

Function 1113F2C0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 68COMMON

Download Yara Rule

APIs

GetProfileStringA.KERNEL32(Windows,Device,,,LPT1:,?,00000080), ref: 1113F2EE
_memmove.LIBCMT ref: 1113F33D

Strings

Device, xrefs: 1113F2E4
,,LPT1:, xrefs: 1113F2DF
Windows, xrefs: 1113F2E9

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ProfileString_memmove
String ID: ,,LPT1:$Device$Windows
API String ID: 1665476579-2967085602
Opcode ID: 716bbe13e6b0c2a6857b669c002c8ae4c99c49e45ff90234edc1af2506825274
Instruction ID: 26e3b1890ae02e26ae762989256faecf06bd366b5ff82a261732e9e447d91945
Opcode Fuzzy Hash: 716bbe13e6b0c2a6857b669c002c8ae4c99c49e45ff90234edc1af2506825274
Instruction Fuzzy Hash: 34113B65E182179AEF009F60DD45BEEF768EF85309F0440A8DDD897246EA327609C7B3

Function 1110D010 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 67threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 1110D03A
EnterCriticalSection.KERNEL32(00000000,?,1106F947,00000001,?), ref: 1110D049
LeaveCriticalSection.KERNEL32(00000000,?,00000000,?), ref: 1110D0BC

Part of subcall function 1110CC90: InitializeCriticalSection.KERNEL32(111EB530,D68DEC44,00000000,00000000,00000000,?,?,1117E388,000000FF,?,1110D074,00000000,?,?,?,1106F947), ref: 1110CCC4
Part of subcall function 1110CC90: EnterCriticalSection.KERNEL32(111EB530,D68DEC44,00000000,00000000,00000000,?,?,1117E388,000000FF), ref: 1110CCE0
Part of subcall function 1110CC90: LeaveCriticalSection.KERNEL32(111EB530,?,?,1117E388,000000FF), ref: 1110CD28

Strings

p.second, xrefs: 1110D0AB
..\ctl32\Refcount.cpp, xrefs: 1110D0A6

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$EnterLeave$CurrentInitializeThread
String ID: ..\ctl32\Refcount.cpp$p.second
API String ID: 2150084884-3525309832
Opcode ID: 17dfb71f85d3623423871dace2d89b21bd8a35a854a257575e45ff8eae89e6f7
Instruction ID: aa3b46e31827c4705b2388170ea92f462920f76e777b69e675d5cc322bee47a2
Opcode Fuzzy Hash: 17dfb71f85d3623423871dace2d89b21bd8a35a854a257575e45ff8eae89e6f7
Instruction Fuzzy Hash: D82181B6D00619AFC711DF95D885BEFF7B8FB08304F10462AE916A7680E7307609CBA1

Function 11017770 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 61COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 11017793
_GetRawWMIStringW@16.PCICL32(Win32_SystemEnclosure,00000001,?,?), ref: 110177BA
CoUninitialize.OLE32 ref: 11017816

Strings

Win32_SystemEnclosure, xrefs: 110177AB
ChassisTypes, xrefs: 110177CA

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InitializeStringUninitializeW@16
String ID: ChassisTypes$Win32_SystemEnclosure
API String ID: 1826621714-2037925671
Opcode ID: 3e094fa14559792c1d5b8febfcfc7d1579bc192a5ef9f71dbb25297aab1bb240
Instruction ID: f98bdc893e9fd32fe616754d7b016d374f1fbf905f29b7d3859fa609e0c3adb8
Opcode Fuzzy Hash: 3e094fa14559792c1d5b8febfcfc7d1579bc192a5ef9f71dbb25297aab1bb240
Instruction Fuzzy Hash: 771123B5E012259BDB51DB60CC81BAFB6E89F84708F4004B8EC5CDB248FA39ED04C7A1

Function 11151400 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 58COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(00000000,00000000,00000001,?,?,?,?,110200EF,000000FF,000000FF,?,?,?,?), ref: 11151468
DeleteObject.GDI32(?), ref: 11151490
CreateSolidBrush.GDI32(?), ref: 11151497

Strings

m_hWnd, xrefs: 11151453
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1115144E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: BrushCreateDeleteInvalidateObjectRectSolid
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 186785674-2830328467
Opcode ID: 0f61de9e46cd278ef660cbfdeb329b29db82ef440ca53de4eb441dc1b82f1111
Instruction ID: 0d0c08ff74a57ef6ba33dd90404a6ab1e24269b8ab5a5548580249a3c5648128
Opcode Fuzzy Hash: 0f61de9e46cd278ef660cbfdeb329b29db82ef440ca53de4eb441dc1b82f1111
Instruction Fuzzy Hash: C811E935700701ABD761DA64C884FDBFBEDAB8D764F008619F67A97280D730B881C7A0

Function 11143300 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 57COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,0000194E,?,00000400), ref: 1114332F
wsprintfA.USER32 ref: 11143366

Strings

..\ctl32\util.cpp, xrefs: 1114337B
i < _tsizeof (buf), xrefs: 11143380
#%d, xrefs: 11143360

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LoadStringwsprintf
String ID: #%d$..\ctl32\util.cpp$i < _tsizeof (buf)
API String ID: 104907563-2296142801
Opcode ID: d9a93e4628ff9623d12c8545375990caae6978ca115b73ee2bdc908e116f0fa2
Instruction ID: 0b57fc55363c9780ec1eba2f1e8c51a2066cc581ea500c8ca2ee88f71127f8c5
Opcode Fuzzy Hash: d9a93e4628ff9623d12c8545375990caae6978ca115b73ee2bdc908e116f0fa2
Instruction Fuzzy Hash: 51110CFAE1522867D710DA65DD80FEEF3BC9B40608F144065FF09B3281EA306A158BA4

Function 11141050 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 44COMMON

Download Yara Rule

APIs

LoadStringA.USER32(00000000,00000000,?,1110F846), ref: 11141068
wsprintfA.USER32 ref: 1114107E

Strings

i < cchBuf, xrefs: 11141095
..\ctl32\util.cpp, xrefs: 11141090
#%d, xrefs: 11141078

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LoadStringwsprintf
String ID: #%d$..\ctl32\util.cpp$i < cchBuf
API String ID: 104907563-3240211118
Opcode ID: 0bb6504317ea197f224e5eafa238f1e881c185ed3c09dc82a2592a4a3ed90df6
Instruction ID: 4f2d498bfc0dc64ab7b88e040e08f464cf564c4dfb99dd2b94d033efe742b6ac
Opcode Fuzzy Hash: 0bb6504317ea197f224e5eafa238f1e881c185ed3c09dc82a2592a4a3ed90df6
Instruction Fuzzy Hash: 7AF0F676F022253BD7019E9ADC84DDFB75CEF8469CB044021FD0893240DA30B91083B5

Function 1101D5A0 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 41registrywindowCOMMON

Download Yara Rule

APIs

LoadIconA.USER32(00000000,0000139A), ref: 1101D5FF
LoadCursorA.USER32(00000000,00007F00), ref: 1101D60F
RegisterClassExA.USER32(00000030), ref: 1101D631
GetLastError.KERNEL32 ref: 1101D637

Strings

0, xrefs: 1101D5BC

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Load$ClassCursorErrorIconLastRegister
String ID: 0
API String ID: 1253014879-4108050209
Opcode ID: b8f3f12353df1dfa877711d97018d686675911807c73b9da0d3e71397bd586bf
Instruction ID: 74b796de2076f6e97241d07b21eba49089d87d5f5b2dbb3e08999f276665ead4
Opcode Fuzzy Hash: b8f3f12353df1dfa877711d97018d686675911807c73b9da0d3e71397bd586bf
Instruction Fuzzy Hash: 05014474D1131AABDB01DFE0D959B9DFB74BB0430CF104525E614BA284DB7551048F96

Function 11004180 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 39windowsleepCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000060C,00000002,00000000), ref: 1100419E
Sleep.KERNEL32(00000064), ref: 110041A6
SendMessageA.USER32(?,0000060C,00000003,00000000), ref: 110041B9

Strings

m_pToolbar, xrefs: 110041CF
e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h, xrefs: 110041CA

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend$Sleep
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h$m_pToolbar
API String ID: 2158920685-281161189
Opcode ID: 7cb452cc2f17560cd451a613032f4b6501dc960235635e8ebf8cdebbdd16951f
Instruction ID: bd06d62644044f33e03f8daabfc06d45a633f249513bc6665d3edd4de073485f
Opcode Fuzzy Hash: 7cb452cc2f17560cd451a613032f4b6501dc960235635e8ebf8cdebbdd16951f
Instruction Fuzzy Hash: 26F0A931B80711AFE325EB60DC85F9AB3AABF89714F014668F7019B2C0D770A811CB91

Function 110F4030 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 37synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00000000,?,?,11104EA5), ref: 110F4041
InterlockedExchange.KERNEL32(?,00000000), ref: 110F404D
CloseHandle.KERNEL32(00000000), ref: 110F4058
InterlockedIncrement.KERNEL32(111EB22C), ref: 110F4085

Strings

s%d client died, u=%s, xrefs: 110F4069

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Interlocked$CloseExchangeHandleIncrementObjectSingleWait
String ID: s%d client died, u=%s
API String ID: 174804551-366056384
Opcode ID: d97db16bd407120dc035dcaa8c2ee9fbbed48e5cd88d0f72cc2efdff1ab1d8f2
Instruction ID: dbd9a0ada11b11d9f1452c9bd4074fd1830116b24ec5c5d7ed27be418dce7222
Opcode Fuzzy Hash: d97db16bd407120dc035dcaa8c2ee9fbbed48e5cd88d0f72cc2efdff1ab1d8f2
Instruction Fuzzy Hash: 9EF0B475A00212ABE7219F68EE88F9BB7ECEF05749F110969FD41D3104D770A440CB31

Function 11033780 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 11033798
GetClassNameA.USER32(?,?,00000400), ref: 110337C6

Strings

ComboBox, xrefs: 110337D2
CltAutoLogon.cpp, xrefs: 110337A7
IsWindow(hWin), xrefs: 110337AC

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClassNameWindow
String ID: CltAutoLogon.cpp$ComboBox$IsWindow(hWin)
API String ID: 697123166-163732079
Opcode ID: e07293e19fa805634986d227886f6e5712b70b0c105655045ba2b5ae284a9c9c
Instruction ID: 7777115e1bfd17fbb68ee1e344f5923338d2ee040b05baa55a6615f76012ce2b
Opcode Fuzzy Hash: e07293e19fa805634986d227886f6e5712b70b0c105655045ba2b5ae284a9c9c
Instruction Fuzzy Hash: 06F0B4B5F1162DABDB01EB648C41FEEF77C9F04208F4040A4FF18A6141EA317A058BDA

Function 11017380 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 26windowCOMMON

Download Yara Rule

APIs

FindWindowA.USER32(IPTip_Main_Window,00000000), ref: 11017388
GetWindowLongA.USER32(00000000,000000F0), ref: 11017397
PostMessageA.USER32(00000000,00000112,0000F060,00000000), ref: 110173B8
SendMessageA.USER32(00000000,00000112,0000F060,00000000), ref: 110173CB

Strings

IPTip_Main_Window, xrefs: 11017383

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageWindow$FindLongPostSend
String ID: IPTip_Main_Window
API String ID: 3445528842-293399287
Opcode ID: f1d2bfff102f361242baea7a53f5904f2950652075caf7517beb86089a827255
Instruction ID: e8c98fe49d486c14b11a6c899bb244836afc3a109fe3c27dba25912dbba3b22d
Opcode Fuzzy Hash: f1d2bfff102f361242baea7a53f5904f2950652075caf7517beb86089a827255
Instruction Fuzzy Hash: B8E0DF30B81A3637F33216019C8BFCE69449F01B21F51C110FB22B84C9C7A89440969A

Function 11080190 Relevance: 7.6, APIs: 2, Strings: 3, Instructions: 86COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11080216
wsprintfA.USER32 ref: 1108024D

Strings

..\CTL32\DataStream.cpp, xrefs: 1108025E
%02x, xrefs: 11080210
m_iPos=%d, m_nLen=%d, m_nExt=%d, m_pData=%x {%s}, xrefs: 11080247

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %02x$..\CTL32\DataStream.cpp$m_iPos=%d, m_nLen=%d, m_nExt=%d, m_pData=%x {%s}
API String ID: 2111968516-476189988
Opcode ID: fd91cd90e9d8e1b56226fba69e5a118b6741aece0cecc4d0d79f03e5595ae4fb
Instruction ID: af9b81833624a54b46e3f1f5be8b1ede284f62e5fa41a733c4938c92d72c9f5f
Opcode Fuzzy Hash: fd91cd90e9d8e1b56226fba69e5a118b6741aece0cecc4d0d79f03e5595ae4fb
Instruction Fuzzy Hash: 5A21E571E062699BDB14CF68DCC0EAFF3F8EB88304F0085AEE81A97505D630AD448B60

Function 11025310 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11025327
GetDlgItem.USER32(?,00001399), ref: 11025361
TranslateMessage.USER32(?), ref: 1102537A
DispatchMessageA.USER32(?), ref: 11025384
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110253C6

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: c810fc961144b80117a49a5b057d9371109f7317b3fc5bd3edfcf6b2722b0fcf
Instruction ID: 5bc5a75a09e9c5603e0e5707333de90a112240db26dc796901c682935277d9c7
Opcode Fuzzy Hash: c810fc961144b80117a49a5b057d9371109f7317b3fc5bd3edfcf6b2722b0fcf
Instruction Fuzzy Hash: 4A21A171E0030B6BD711DA65CC85BEFB3FCAB44748F808429EA1396180EBB5E405CB95

Function 110235A0 Relevance: 7.6, APIs: 5, Instructions: 73windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110235B7
GetDlgItem.USER32(?,00001399), ref: 110235F1
TranslateMessage.USER32(?), ref: 1102360A
DispatchMessageA.USER32(?), ref: 11023614
GetMessageA.USER32(?,00000000,00000000,00000000), ref: 11023656

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$DispatchItemTranslate
String ID:
API String ID: 1381171329-0
Opcode ID: 4913dcb29e12bc82e33b7eae087d9fa30dafe318a9c4b4ef6d620617091a2b9c
Instruction ID: 318584b8c62ea5a7f5d5a1819933ce3e0570c61c1a0e1b4133b94bcd2fcd7415
Opcode Fuzzy Hash: 4913dcb29e12bc82e33b7eae087d9fa30dafe318a9c4b4ef6d620617091a2b9c
Instruction Fuzzy Hash: 2821C671E0431B6BD721DF65CC85FAFB3ECAB48748F808469EA1696680FB74E501CB91

Function 1100F0A0 Relevance: 7.6, APIs: 5, Instructions: 60COMMON

Download Yara Rule

APIs

std::_Locinfo::_Locinfo_dtor.LIBCPMT ref: 1100F0D2

Part of subcall function 1115CB84: _setlocale.LIBCMT ref: 1115CB96

_free.LIBCMT ref: 1100F0E4

Part of subcall function 1115EF45: HeapFree.KERNEL32(00000000,00000000,?,11167B06,00000000,?,1110C98E,?,?,?,?,111415F2,?,?,?), ref: 1115EF5B
Part of subcall function 1115EF45: GetLastError.KERNEL32(00000000,?,11167B06,00000000,?,1110C98E,?,?,?,?,111415F2,?,?,?), ref: 1115EF6D

_free.LIBCMT ref: 1100F0F7
_free.LIBCMT ref: 1100F10A
_free.LIBCMT ref: 1100F11D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free$ErrorFreeHeapLastLocinfo::_Locinfo_dtor_setlocalestd::_
String ID:
API String ID: 3515823920-0
Opcode ID: 86bad86a8b8b19edc67107b5b16d5312c466d3a82d6cc8338712ff6b0fbb8ec1
Instruction ID: 0bb666fa6b6b947499af82a908b1495e02df1c30b9b87a77c7d4d17958d6a805
Opcode Fuzzy Hash: 86bad86a8b8b19edc67107b5b16d5312c466d3a82d6cc8338712ff6b0fbb8ec1
Instruction Fuzzy Hash: 8611C4F1D006419BE7A0CF99D840A5BFBEDEB41A64F148B6EE465C3740EB71F9048B92

Function 1100A210 Relevance: 7.5, APIs: 5, Instructions: 47synchronizationCOMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,00000000,?,?,?,?,?,?,?,?,1100D500,?,FEFE000F), ref: 1100A22E
DeviceIoControl.KERNEL32(?,?,00000000,00000000,00000000,00000000,?,?), ref: 1100A258
GetLastError.KERNEL32(?,?,?,?,?,?,?,1100D500,?,FEFE000F), ref: 1100A260
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?,?,?,?,1100D500,?,FEFE000F), ref: 1100A274
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,1100D500,?,FEFE000F), ref: 1100A27B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseControlCreateDeviceErrorEventHandleLastObjectSingleWait
String ID:
API String ID: 2062450601-0
Opcode ID: 2a5e387a88e9bbfe1e0d37b518ff79e39b995dbbde7956d326b26ca573eebefb
Instruction ID: 0293352fad110091cd0047525812b2bba735b5f00bf482566cb1caadd8251421
Opcode Fuzzy Hash: 2a5e387a88e9bbfe1e0d37b518ff79e39b995dbbde7956d326b26ca573eebefb
Instruction Fuzzy Hash: 6A01F731A01626B7E7118E68CC49F9DB768AB44775F308320FA24E72C4C770AA4187A5

Function 11031550 Relevance: 7.5, APIs: 1, Strings: 4, Instructions: 28COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031597

Strings

_SW, xrefs: 1103156C
%s%s%s.bin, xrefs: 11031591
_HW, xrefs: 11031560
_HF, xrefs: 11031578, 1103157D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s%s.bin$_HF$_HW$_SW
API String ID: 2111968516-1781471741
Opcode ID: 565b4463a94341382a2d70559066af6f65bb55e3a261599593d899e86c3e404b
Instruction ID: 19dd192888bd83abce3bd9d362f3ce3bcdd94ce0b59474c1767756108f924225
Opcode Fuzzy Hash: 565b4463a94341382a2d70559066af6f65bb55e3a261599593d899e86c3e404b
Instruction Fuzzy Hash: AFE09B64D34A4CABF74046588D037EEB79C1B4475AF8440C0FEAB9A2D1E576D40045D6

Function 11020160 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 196windowCOMMON

Download Yara Rule

APIs

SetFocus.USER32(?), ref: 110201C9
GetClientRect.USER32(00000000,?), ref: 1102028A

Strings

m_hWnd, xrefs: 11020275
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11020270

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ClientFocusRect
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 2747958457-2830328467
Opcode ID: 407e61a9e45e81fc948c783a8e40e51135219adf40b89328f7a7cfaed855a10f
Instruction ID: e9868b5889d75877f483408a77d0a38d8fffbb8a8c2a527ba33ff835a6d2d26a
Opcode Fuzzy Hash: 407e61a9e45e81fc948c783a8e40e51135219adf40b89328f7a7cfaed855a10f
Instruction Fuzzy Hash: 8461B875F002199BDB44CF68C890BAFF3EAFF88314F50825EE91697285CB35A945CB91

Function 11012010 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 183COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 110121CB

Strings

+, xrefs: 11012169
%, xrefs: 1101215D
$, xrefs: 11012067

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: f5eba78de288bf71ddb404427f35f71b3bf438dc220002d59c04fcc116e25f95
Instruction ID: 1e9de9a76a109b4775c67d340ba2fbf7a4b22689a844fad27f9add8d0ddf14e0
Opcode Fuzzy Hash: f5eba78de288bf71ddb404427f35f71b3bf438dc220002d59c04fcc116e25f95
Instruction Fuzzy Hash: 1A516FF2E002459ADB07DE54C8807CE7BF5EB55344F3086C8E954AB29AEA3DC9858FD0

Function 11012220 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 177COMMON

Download Yara Rule

APIs

swprintf.LIBCMT ref: 110123C9

Strings

%, xrefs: 1101235B
$, xrefs: 11012277
+, xrefs: 11012367

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: swprintf
String ID: $$%$+
API String ID: 233258989-3202472541
Opcode ID: 9bb007629a328de084104fbbbdc043e9248b4aa2a9bf1a909fa02e76c9b1dbd2
Instruction ID: 08c7286c33273b39d95e5258a02602f6dbc7d735927965df82c25053acb3a10e
Opcode Fuzzy Hash: 9bb007629a328de084104fbbbdc043e9248b4aa2a9bf1a909fa02e76c9b1dbd2
Instruction Fuzzy Hash: BA516CF2E04249AADF15CE98C8847CE7BF5AB05304F30C5C9D854AB299EA3CC9958F91

Function 11021480 Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 165windowCOMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 110214E2
IsWindowVisible.USER32(00000000), ref: 110215B3
wsprintfA.USER32 ref: 110215F7

Strings

%d,%d,%d,%d,%d,%d, xrefs: 110215F1

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf$VisibleWindow
String ID: %d,%d,%d,%d,%d,%d
API String ID: 1671172596-1913222166
Opcode ID: 9e5697d67ffe02a3b1abca211cfef4a7e976905aed1504f0e68f747a528172a3
Instruction ID: f0af9b56f2b9bba52cb6942c3e228837d7f7961b36e7e070e55aac6935ab48cd
Opcode Fuzzy Hash: 9e5697d67ffe02a3b1abca211cfef4a7e976905aed1504f0e68f747a528172a3
Instruction Fuzzy Hash: 08519E74600215AFD710CB68CC84FAAF3F9BF88704F508599F6599B281DA70ED45CBA1

Function 11114570 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 1111458F
DeleteObject.GDI32(00000000), ref: 111146B3
GetTickCount.KERNEL32 ref: 111146C9

Strings

BltPending skipping Blt, sinceUpdate=%d ms, sinceBlt=%d ms, from=%s, xrefs: 111145DE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CountTick$DeleteObject
String ID: BltPending skipping Blt, sinceUpdate=%d ms, sinceBlt=%d ms, from=%s
API String ID: 3011517232-3209293507
Opcode ID: 6786a6910f30a135b9b30da4f020685f348bff33144620046af2da6e7e4b3f49
Instruction ID: c776d75cbe25a2ed6562b3e7a8019fdfdfffd85b7a5b1a060dc928e5d4c63ce3
Opcode Fuzzy Hash: 6786a6910f30a135b9b30da4f020685f348bff33144620046af2da6e7e4b3f49
Instruction Fuzzy Hash: 37418071A40B028FD714CF79CD846AFF7E1FB84619F108A3ED56A96A44EB306540CF01

Function 1101E7A0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 112COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000013C2), ref: 1101E7AF
EnableWindow.USER32(00000000,00000001), ref: 1101E8CD

Strings

m_hWnd, xrefs: 1101E8BB
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101E8B6

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableItemWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3833022359-2830328467
Opcode ID: 00399a8d030bdb489ecae9ee113d2b0d096411a8d208a559ef943ec0fd6dca56
Instruction ID: 34fd2eca1271dedb198bd2585a3f0f862568950f9331c87b34b5326bee67e1dd
Opcode Fuzzy Hash: 00399a8d030bdb489ecae9ee113d2b0d096411a8d208a559ef943ec0fd6dca56
Instruction Fuzzy Hash: 2C319231740211ABE311CE99CC81F4EB7D6BBC8B10F258669F7599F2C4C6B4ED418795

Function 110760C0 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 109COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000F0), ref: 11076101
CopyRect.USER32(?,00000004), ref: 1107612F

Strings

m_hWnd, xrefs: 110760EE
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110760E9

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CopyLongRectWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 127971810-2830328467
Opcode ID: cf68280035de1fe54a1a720649c92326295a3a8fe1bfde21ce6f951e53ce3818
Instruction ID: ff080e57116ff1290f1c0b571dabd1b6a82a8b467d5a83dbd2db93799ab353bd
Opcode Fuzzy Hash: cf68280035de1fe54a1a720649c92326295a3a8fe1bfde21ce6f951e53ce3818
Instruction Fuzzy Hash: 11417E35E00606DBEB14CE68DCC4A5EB7F5EF84314F28C56AD89B97606EB30E940CB54

Function 11031080 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 104COMMON

Download Yara Rule

Strings

Error. ExitMetro code cannot init kbfilter, xrefs: 11031169
Exit Win10 Start screen (%s), xrefs: 110310D6
Error. WindowsD not generated, xrefs: 11031182

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseHandle$ClassCodeCursorExitFromNameObjectOpenPointProcessSingleVersionWaitWindowwsprintf
String ID: Error. ExitMetro code cannot init kbfilter$Error. WindowsD not generated$Exit Win10 Start screen (%s)
API String ID: 1142261775-3225996774
Opcode ID: ddb145364752b9d4b4e28b8667d44694595bbbeaa0473084a48ea35945b71fe3
Instruction ID: 0dcceb4b5438a30ce91795314b6a7967f92a906ed2eb3efa1b46048276e8f4e2
Opcode Fuzzy Hash: ddb145364752b9d4b4e28b8667d44694595bbbeaa0473084a48ea35945b71fe3
Instruction Fuzzy Hash: A831297AE142659FE710DFD4EC01BEEBBB4EB48659F0006AADC1953380FB716900C6D1

Function 1109A480 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 103COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 1109A501
__CxxThrowException@8.LIBCMT ref: 1109A516

Strings

IsA(), xrefs: 1109A4E1, 1109A55F
..\CTL32\IEFavourites.cpp, xrefs: 1109A4DC, 1109A55A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception
String ID: ..\CTL32\IEFavourites.cpp$IsA()
API String ID: 3728558374-3791668299
Opcode ID: d0822f0a981bdd95bd232d4de479f7240f25d2c49ad814ce319cfba2158c60c3
Instruction ID: 06a4bf26490f782bccfd7dcaca762f237596966ad4d3c83f92070b2d8a81f256
Opcode Fuzzy Hash: d0822f0a981bdd95bd232d4de479f7240f25d2c49ad814ce319cfba2158c60c3
Instruction Fuzzy Hash: 3B31C6B5E0421AABD710CF99DC40B9EFBF8FF44608F50856EE96AA3240E7756504CB90

Function 1113F7F0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 92fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(?,80000000,00000001,00000000,00000003,00000080,00000000,?,1119FBA0,00000000), ref: 1113F887
CreateFileA.KERNEL32(?,80000000,00000003,00000000,00000003,00000080,00000000), ref: 1113F8A7
CloseHandle.KERNEL32(00000000), ref: 1113F8AF

Strings

", xrefs: 1113F83E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFile$CloseHandle
String ID: "
API String ID: 1443461169-123907689
Opcode ID: 94433b36fa71c5901481bff6f41cee3bb894b32878533d44548fc7260ac29274
Instruction ID: 484944ba71c511add1b1797ae57114815f9a100cb2bfc8de4660930836272322
Opcode Fuzzy Hash: 94433b36fa71c5901481bff6f41cee3bb894b32878533d44548fc7260ac29274
Instruction Fuzzy Hash: A021D030A0426AAFE712CE38DD54BD9FB949F82734F2041E0E5D9DB1C9DA71A988C753

Function 110A9370 Relevance: 7.1, APIs: 1, Strings: 3, Instructions: 70COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(80000000,SysListView32,11190210,?,?,?,?,00000000,80000000,?,00000000,00000000), ref: 110A93D8

Strings

m_hWnd, xrefs: 110A93EF
..\ctl32\listview.cpp, xrefs: 110A93EA
SysListView32, xrefs: 110A93D2

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: ..\ctl32\listview.cpp$SysListView32$m_hWnd
API String ID: 716092398-3171529584
Opcode ID: 577267fcef426a9bd77b89dd7a716612928eeedb95a5fdce54bb292f5e543e77
Instruction ID: ca63985c520ba4a47f0b1abef5bb1338dc53c4978f6f20f83993f78e2e4960f8
Opcode Fuzzy Hash: 577267fcef426a9bd77b89dd7a716612928eeedb95a5fdce54bb292f5e543e77
Instruction Fuzzy Hash: 81219D7960021AAFD710DF59DC80F9BBBE9AF88314F10C618F95987281DA70E840CBA0

Function 110882B0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 65libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,0000000E), ref: 1115C331

Part of subcall function 1115C1C0: RegOpenKeyExA.ADVAPI32(80000000,CLSID\{ADB880A6-D8FF-11CF-9377-00AA003B7A11}\InprocServer32,00000000,00020019,?,?), ref: 1115C1F8
Part of subcall function 1115C1C0: RegQueryValueExA.ADVAPI32(?,00000000,00000000,?,?,?,?), ref: 1115C239
Part of subcall function 1115C1C0: ExpandEnvironmentStringsA.KERNEL32(?,?,00000104), ref: 1115C25D
Part of subcall function 1115C1C0: RegCloseKey.ADVAPI32(?), ref: 1115C28A

LoadLibraryA.KERNEL32(?,?,?,?,?), ref: 1115C2F3
LoadLibraryA.KERNEL32(hhctrl.ocx,?,?,?,?), ref: 1115C309

Strings

hhctrl.ocx, xrefs: 1115C304

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: LibraryLoad$AddressCloseEnvironmentExpandOpenProcQueryStringsValue
String ID: hhctrl.ocx
API String ID: 1060647816-2298675154
Opcode ID: a88d0d177349b0acbb3ba20a7be6c4d90aeecbcef0ce15189ecd7f8eb3b84bf1
Instruction ID: 3b9457068e60a9f40374cb345dc5c4bff408698f2ca3b83f337c5c8c9a005b9c
Opcode Fuzzy Hash: a88d0d177349b0acbb3ba20a7be6c4d90aeecbcef0ce15189ecd7f8eb3b84bf1
Instruction Fuzzy Hash: 2911813161621E9BCBC6CFE9C9C0BAEF7ADBB49218B004139E425D3244EB71E640CF65

Function 110181C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 64COMMON

Download Yara Rule

APIs

GetSystemMetrics.USER32(0000005E), ref: 110181CF
GetSystemMetrics.USER32(00002003), ref: 110181E7
FindWindowA.USER32(IPTip_Main_Window,00000000), ref: 1101822A

Strings

IPTip_Main_Window, xrefs: 11018225

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MetricsSystem$FindWindow
String ID: IPTip_Main_Window
API String ID: 3964754823-293399287
Opcode ID: 5af45fcbfd1beaa1243271fef7f500b39c692127a0c9b4db211f7f92eb3976f8
Instruction ID: 405f8311425b7c3811c03fff9e6755b07cbdf4005fab9382e96fe0b0602079de
Opcode Fuzzy Hash: 5af45fcbfd1beaa1243271fef7f500b39c692127a0c9b4db211f7f92eb3976f8
Instruction Fuzzy Hash: F501493BD0061A76DF02EAE49C81ADEB7AC6F05254F0081D7ED05AF048EA39D30987E1

Function 110270D0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 53windowCOMMON

Download Yara Rule

APIs

GetMessageA.USER32(?,00000000,00000000,00000000), ref: 110270FA

Part of subcall function 110CBAE0: EnterCriticalSection.KERNEL32(00000000,00000000,?,001D9EB6,001D8ECC,00000000,00000000), ref: 110CBAFB
Part of subcall function 110CBAE0: SendMessageA.USER32(00000000,00000476,00000000,00000000), ref: 110CBB28
Part of subcall function 110CBAE0: SendMessageA.USER32(00000000,00000475,00000000,?), ref: 110CBB3A
Part of subcall function 110CBAE0: LeaveCriticalSection.KERNEL32(?), ref: 110CBB44

TranslateMessage.USER32(?), ref: 11027110
DispatchMessageA.USER32(?), ref: 11027116

Strings

Exit Msgloop, quit=%d, xrefs: 1102714D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Message$CriticalSectionSend$DispatchEnterLeaveTranslate
String ID: Exit Msgloop, quit=%d
API String ID: 3212272093-2210386016
Opcode ID: d8ba4817e54997e99f33f021fcb2e3ff6dc7d3eccc45b3accec0b08e10f7c19e
Instruction ID: 8aabff2e95174e4f364a9951d32043d55309263a10b5862292db1f090fe5db14
Opcode Fuzzy Hash: d8ba4817e54997e99f33f021fcb2e3ff6dc7d3eccc45b3accec0b08e10f7c19e
Instruction Fuzzy Hash: 22012D77E0122A76E711D6E59CC1F6FB3AC5B54708F904475FA1492185EB64B40487E2

Function 110142D0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 47COMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(?,SysHeader32,11190210,?,?,?,?,?,?,?,00000000,00000000), ref: 1101430C

Strings

m_hWnd, xrefs: 11014320
SysHeader32, xrefs: 11014306
..\ctl32\headctrl.cpp, xrefs: 1101431B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: ..\ctl32\headctrl.cpp$SysHeader32$m_hWnd
API String ID: 716092398-4050302278
Opcode ID: a42e18afa407a44595b82524c58cc0e4270d388bc2f2a8b1fefdc574888f12c3
Instruction ID: 1023017d2b60d62eec3e63ba36564815a45062483463bebccc587b9f94db51eb
Opcode Fuzzy Hash: a42e18afa407a44595b82524c58cc0e4270d388bc2f2a8b1fefdc574888f12c3
Instruction Fuzzy Hash: 09014B7660021ABBC710DE99DC85EDBB7ADAF88714F018519FA18D7280DA70F85187A0

Function 11135110 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 43libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 11094970: LoadLibraryA.KERNEL32(USER32,000000FF,11181ECB,110CA25A), ref: 11094979
Part of subcall function 11094970: GetProcAddress.KERNEL32(00000000,GetMonitorInfoA), ref: 1109498D
Part of subcall function 11094970: GetProcAddress.KERNEL32(00000000,EnumDisplayMonitors), ref: 1109499A
Part of subcall function 11094970: GetProcAddress.KERNEL32(?,EnumDisplayDevicesA), ref: 110949A7
Part of subcall function 11094970: GetProcAddress.KERNEL32(?,MonitorFromRect), ref: 110949B4

LoadLibraryA.KERNEL32(dwmapi.dll,D68DEC44,00000000,?,00000000,00000000,11179518,000000FF,?,110F5A40,?), ref: 11135157
GlobalAddAtomA.KERNEL32(NSMBlankWnd), ref: 11135180

Strings

dwmapi.dll, xrefs: 11135152
NSMBlankWnd, xrefs: 1113515D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressProc$LibraryLoad$AtomGlobal
String ID: NSMBlankWnd$dwmapi.dll
API String ID: 2642129572-3254748277
Opcode ID: 894380f5edba0a5ead02913e75a21bb5e61c8fd1bebb0cc0a454058174834262
Instruction ID: bd5f225c83dc93164d5c25ac5ea6240ffa54f2a7959d3c96b130d2abd917791c
Opcode Fuzzy Hash: 894380f5edba0a5ead02913e75a21bb5e61c8fd1bebb0cc0a454058174834262
Instruction Fuzzy Hash: EE0127B5A056549FD321CF6AC880B9AFBE8FF49710F00452FE46AD3600D7706400CB95

Function 11153290 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 42COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(00000000,00000000,00000000), ref: 111532E3
UpdateWindow.USER32(?), ref: 1115330E

Strings

m_hWnd, xrefs: 111532CE, 111532FD
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 111532C9, 111532F8

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InvalidateRectUpdateWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1236202516-2830328467
Opcode ID: daff5efa8676acabc49472ca6907f6e4b1d795cb58f9ce2ec08ab9e98737f888
Instruction ID: 09a0be6ec69e64366c52fcf16efe91d8b1cf4b79ed0a0e4706558c63e0136765
Opcode Fuzzy Hash: daff5efa8676acabc49472ca6907f6e4b1d795cb58f9ce2ec08ab9e98737f888
Instruction Fuzzy Hash: 7F012839F04B16A7C3A09761DC40F8AF364BF45398F258928F1B627580EB70B880C792

Function 110153F0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001009,00000000,00000000), ref: 110A9BCD

Strings

m_hWnd, xrefs: 11015403, 110A9BB3
..\ctl32\listview.cpp, xrefs: 110A9BAE
..\ctl32\liststat.cpp, xrefs: 110153FE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: ..\ctl32\liststat.cpp$..\ctl32\listview.cpp$m_hWnd
API String ID: 3850602802-2727927828
Opcode ID: 748d148441ded4a767f42e3fef6a40795c67caafe928e53997df953952464b86
Instruction ID: bb25ab1abee78bac8a497fcebc3e6dc9fa5e3d852267ca85c8011181ffb66399
Opcode Fuzzy Hash: 748d148441ded4a767f42e3fef6a40795c67caafe928e53997df953952464b86
Instruction Fuzzy Hash: 80F0F038F80721AFE321E641EC40FC5B2C49B0970AF014468F1466B2D0E6B0F480C391

Function 110EB2C0 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 36COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110EB2E8

Strings

..\CTL32\NSWin32.cpp, xrefs: 110EB2CE, 110EB2F4
IsWindow(hRich), xrefs: 110EB2F9
lpNmHdr!=0, xrefs: 110EB2D3

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window
String ID: ..\CTL32\NSWin32.cpp$IsWindow(hRich)$lpNmHdr!=0
API String ID: 2353593579-1331251348
Opcode ID: 6034a8cc6836582f9e44dbb1010c57420601c91a60321cbb0da7d78f9f98ecab
Instruction ID: ea47269738d455f5d84149c29d34a4ddb15389dbcc172be3cfc4bffa3be59314
Opcode Fuzzy Hash: 6034a8cc6836582f9e44dbb1010c57420601c91a60321cbb0da7d78f9f98ecab
Instruction Fuzzy Hash: 7CF0E22AF029626BC212AD23BC0AF8ABB589F41BB9F148065FC0836101E3347150C5F2

Function 11080280 Relevance: 7.0, APIs: 1, Strings: 3, Instructions: 31COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 110802D7

Strings

..\CTL32\DataStream.cpp, xrefs: 11080294
IsA(), xrefs: 11080299, 110802C0
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 110802BB

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID: ..\CTL32\DataStream.cpp$IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 269201875-1875806619
Opcode ID: d4ed4ae2a7ae6d3675677fb88f509ba8019ef64ff28cf50cbe0b901f63ad8a3a
Instruction ID: 1a0368208216827f837f1c70b73d689bbb94472469b0d73afefbc9e2b04da718
Opcode Fuzzy Hash: d4ed4ae2a7ae6d3675677fb88f509ba8019ef64ff28cf50cbe0b901f63ad8a3a
Instruction Fuzzy Hash: 53F0A0B9F086661BEB71EF64AC00B8AB7D41F40648F044598E8A227285DBA9750882E3

Function 111350B0 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 27threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

CreateThread.KERNEL32(00000000,00001000,11134EF0,00000000,00000000,111360B2), ref: 111350EE
CloseHandle.KERNEL32(00000000,?,111360B2,AutoICFConfig,00000000,00000000), ref: 111350F5

Strings

Client, xrefs: 111350CC
*AutoICFConfig, xrefs: 111350C7

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread__wcstoi64
String ID: *AutoICFConfig$Client
API String ID: 3257255551-59951473
Opcode ID: e643593b71a76a6575c69df5965fe468e1ef42a883d785b21bddbc43a8df8c94
Instruction ID: c4187b8bdea89816fe34badbdf5e5b21460dfbbf7f0180a847def45d09ce6938
Opcode Fuzzy Hash: e643593b71a76a6575c69df5965fe468e1ef42a883d785b21bddbc43a8df8c94
Instruction Fuzzy Hash: 6DE0D8347903197AF2219AE18D86F69F31CA740F67F500124F721550C8DAA560408B69

Function 11132110 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

CreateThread.KERNEL32(00000000,00001000,11131FD0,00000000,00000000,1113DDDD), ref: 11132144
CloseHandle.KERNEL32(00000000,?,?,1113DDDD), ref: 1113214B

Strings

_debug, xrefs: 11132123
UnresponsiveTime, xrefs: 1113211E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateHandleThread__wcstoi64
String ID: UnresponsiveTime$_debug
API String ID: 3257255551-835906747
Opcode ID: 1af91f3071c94fb62720d63b5983096a5f8b2bfe3bf2e1850ae68cebb823d943
Instruction ID: b96ef2307ae7ebdfde1ecbd7cfef0b51466bcaa2af569c31fed7b4def2d2caf6
Opcode Fuzzy Hash: 1af91f3071c94fb62720d63b5983096a5f8b2bfe3bf2e1850ae68cebb823d943
Instruction Fuzzy Hash: 06E0C235794308BBF2519BE2CD46FB9F22CE744B56F600154FB19A51C8DA907400837E

Function 1101D320 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D34B
EnableWindow.USER32(00000000,?), ref: 1101D356

Strings

m_hWnd, xrefs: 1101D336
e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D331

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnableItemWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 3833022359-1986719024
Opcode ID: c71ca91f13feed13b3bc05c4493c38aade29247817d9b6a0f5fec4147c6e871a
Instruction ID: 7e691b7ca0e1f7b77dfb2b35895860fbe924076f9e4ffff954b04ae0baed3e98
Opcode Fuzzy Hash: c71ca91f13feed13b3bc05c4493c38aade29247817d9b6a0f5fec4147c6e871a
Instruction Fuzzy Hash: F9E08676A1032ABFD310AA61DC44E9BF39CEB54365F00C525FA6587640D675E9408BA1

Function 1101D370 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 23COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 1101D39F
ShowWindow.USER32(00000000), ref: 1101D3A6

Strings

m_hWnd, xrefs: 1101D386
e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h, xrefs: 1101D381

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemShowWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\nsmdlg.h$m_hWnd
API String ID: 3351165006-1986719024
Opcode ID: 26a341726d1ddd0f0f404ba8ae81e91122c2c12030b82f46958dbd456c34451b
Instruction ID: 22aff64a694e51330ce59fe181aed093162e9677a7f53fd9f9c662890ba8970e
Opcode Fuzzy Hash: 26a341726d1ddd0f0f404ba8ae81e91122c2c12030b82f46958dbd456c34451b
Instruction Fuzzy Hash: F4E04F75A1032AAFC300AA61DC48E9BB39CDB44254F00D025FA6946240D674A84087A1

Function 110130B0 Relevance: 6.3, APIs: 4, Instructions: 345COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 11013174
__CxxThrowException@8.LIBCMT ref: 11013189
std::exception::exception.LIBCMT ref: 1101348F
__CxxThrowException@8.LIBCMT ref: 110134A4

Part of subcall function 11010E60: _memmove.LIBCMT ref: 11010E9D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$_memmove
String ID:
API String ID: 2385204509-0
Opcode ID: f132d72b313d6da956708a1f91729de2c69efacb66ceec15231ac84db7e37611
Instruction ID: 8793fad7f5683914769a2cfd932568d20079b7e9bce746727b368bb1a4f40aa5
Opcode Fuzzy Hash: f132d72b313d6da956708a1f91729de2c69efacb66ceec15231ac84db7e37611
Instruction Fuzzy Hash: 3AD171B5D042199FCB15CF98C880BEEBBF9AF48704F10855DE55AAB340DB34AA44CBA1

Function 110EA610 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 136COMMON

Download Yara Rule

APIs

SetLastError.KERNEL32(00000057,00000000,00000001,00000000,?,00000000,1104872C,00000001,00000000,00000000), ref: 110EA764

Strings

m_plugin_table[pluginid] == NULL, xrefs: 110EA690
InitPlugin(0x%08x, %d), xrefs: 110EA642
NSSClientPlugin.cpp, xrefs: 110EA68B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ErrorLast
String ID: InitPlugin(0x%08x, %d)$NSSClientPlugin.cpp$m_plugin_table[pluginid] == NULL
API String ID: 1452528299-146751015
Opcode ID: 76ac588ff1ebd66bce863c560cb855f5a5923e9d0b5d584e0632ee1eba50fcfe
Instruction ID: 1aca4bb702d4083d52fb3f79d59b2521a96457461aa725a5bf898a4b299f2605
Opcode Fuzzy Hash: 76ac588ff1ebd66bce863c560cb855f5a5923e9d0b5d584e0632ee1eba50fcfe
Instruction Fuzzy Hash: 1B410775E01216EFDB01CBBA9C44B9EBBF4AF99754F004169E856E7280EB709940CBA1

Function 110605A0 Relevance: 6.1, APIs: 4, Instructions: 131registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(00000003,?,00000000,00020019,?,?), ref: 110605DC
RegEnumValueA.ADVAPI32(?,00000000,?,?,00000000,?,?,?,?,00000000), ref: 11060634
RegEnumValueA.ADVAPI32(?,00000001,?,00000080,00000000,?,?,00000480), ref: 11060723
RegCloseKey.ADVAPI32(?), ref: 11060734

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnumValue$CloseOpen
String ID:
API String ID: 3785232357-0
Opcode ID: 25943d980a4966999e43a4e048748bd08f72bea2f7c1e601663563a83b660ce9
Instruction ID: c2f02ad44c6ce0858e032efbe6d9bcc75193652d88222df2dc9083196a348c71
Opcode Fuzzy Hash: 25943d980a4966999e43a4e048748bd08f72bea2f7c1e601663563a83b660ce9
Instruction Fuzzy Hash: ED413DB19006299EDB20CB54CC84FDFB7B9AB48305F1081D9E649D7145EB70AE88CFA1

Function 110290C0 Relevance: 6.1, APIs: 4, Instructions: 104sleepthreadwindowCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00001000,Function_00026F50,00000000,00000000,111E8098), ref: 110290E3
Sleep.KERNEL32(00000032), ref: 11029102
PostThreadMessageA.USER32(?,00000500,?,00000000), ref: 11029124
Sleep.KERNEL32(00000032), ref: 1102912C

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: SleepThread$CreateMessagePost
String ID:
API String ID: 3347742789-0
Opcode ID: 8dc8e703b755f952844f9a45ca4f6b634a78a7a3f3669541be80a35cc33dd38b
Instruction ID: f39eb52afa5e94cbd5946b4a2695ac391b4202dfd17cf21596056520515cd056
Opcode Fuzzy Hash: 8dc8e703b755f952844f9a45ca4f6b634a78a7a3f3669541be80a35cc33dd38b
Instruction Fuzzy Hash: 1031E972D01630AFE302DAE5CC81B79BBA4A784768F544139FF68972C4D6716801CBD1

Function 1109D7A0 Relevance: 6.1, APIs: 4, Instructions: 86memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),00000000,00000000,?,001D8F50,?), ref: 1109D7D8
GetTokenInformation.ADVAPI32(00000000,00000001(TokenIntegrityLevel),?,00000001,00000001), ref: 1109D7F4
AllocateAndInitializeSid.ADVAPI32(?,00000001,00000012,?,?,?,?,?,?,?,111E9794,?,00000001,00000001), ref: 1109D820
EqualSid.ADVAPI32(?,?,?,00000001,00000001), ref: 1109D833

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: InformationToken$AllocateEqualInitialize
String ID:
API String ID: 1878589025-0
Opcode ID: c28e788ae2b7cbc3c44e33269123c4a2687a19187b433da749dfebf5a2a4fc3f
Instruction ID: 5d694f15cfd43de924ea27028540399653c3ff79274e47badb7ab612dbd66e28
Opcode Fuzzy Hash: c28e788ae2b7cbc3c44e33269123c4a2687a19187b433da749dfebf5a2a4fc3f
Instruction Fuzzy Hash: B5217171F4121EABEB00CE94DC81BBFB3B8EB44704F004069E92DDB281E671A904CBA1

Function 110CD130 Relevance: 6.1, APIs: 4, Instructions: 82COMMON

Download Yara Rule

APIs

Part of subcall function 110CC8A0: EnterCriticalSection.KERNEL32(00000000,00000000,D68DEC44,00000000,00000000,11116B8B,110CCB20,?,00000001), ref: 110CC8DA
Part of subcall function 110CC8A0: LeaveCriticalSection.KERNEL32(00000000), ref: 110CC942

IsWindow.USER32(?), ref: 110CD18B

Part of subcall function 110CAD40: GetCurrentThreadId.KERNEL32 ref: 110CAD49

RemovePropA.USER32(?), ref: 110CD1B8
DeleteObject.GDI32(?), ref: 110CD1CC
DeleteObject.GDI32(?), ref: 110CD1D6

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalDeleteObjectSection$CurrentEnterLeavePropRemoveThreadWindow
String ID:
API String ID: 3515130325-0
Opcode ID: 3960ef3f7da62a1635a643b37961cca5e072af5ffc0bf9d60640a3e5d507a12a
Instruction ID: 3d9644484698be90544fa85b94ba53cfa9a555330166210202983e28698588d1
Opcode Fuzzy Hash: 3960ef3f7da62a1635a643b37961cca5e072af5ffc0bf9d60640a3e5d507a12a
Instruction Fuzzy Hash: C9214CB5A00751ABDB20DF69C844B5FFBF8AB44B18F004A6EE86693690D775E440CBA0

Function 11031460 Relevance: 6.1, APIs: 1, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

wsprintfA.USER32 ref: 11031516

Strings

m_pDoInv == NULL, xrefs: 11031493
clientinv.cpp, xrefs: 1103148E
%s%s.bin, xrefs: 11031510

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: wsprintf
String ID: %s%s.bin$clientinv.cpp$m_pDoInv == NULL
API String ID: 2111968516-1342029716
Opcode ID: 6bcf009ca2850f9c1d226241d9006845b058b7a9e0e7cfe6e0bf7292bb72571d
Instruction ID: 90f527033a09650ad0d1046df9cb7e3d6655467612cf08795334f84174408380
Opcode Fuzzy Hash: 6bcf009ca2850f9c1d226241d9006845b058b7a9e0e7cfe6e0bf7292bb72571d
Instruction Fuzzy Hash: D62160B5E14705AFE710CF65DC40BAAB7E8EB44618F10856EE96597381EB34A900CB51

Function 110082E9 Relevance: 6.1, APIs: 4, Instructions: 68windowCOMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 11008383
SelectObject.GDI32(?,?), ref: 110083A5
DeleteDC.GDI32(?), ref: 110083B2
DeleteObject.GDI32(?), ref: 110083BF
GetDC.USER32(00000000), ref: 110083ED
CreateCompatibleDC.GDI32(00000000), ref: 110083FA
CreateCompatibleBitmap.GDI32(?,00000004,00000010), ref: 11008411
SelectObject.GDI32(?,00000000), ref: 11008425

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Object$CompatibleCreateDeleteSelect$Bitmap_free
String ID:
API String ID: 2407909620-0
Opcode ID: d5f04eef9a70aa9d6029d31c10897097a89ad1dbe25325c1d3cf1b8c4e3372d2
Instruction ID: a52b3c2e6f8075aec7ad6dbdb5c0eb9f942f3bad0fcbc0102c1ccebfaa995588
Opcode Fuzzy Hash: d5f04eef9a70aa9d6029d31c10897097a89ad1dbe25325c1d3cf1b8c4e3372d2
Instruction Fuzzy Hash: 2E21FF79600A019FD264DF28C994AEBB7E6FBC8318F10892DE56A87311CB30F842CB50

Function 1109C7B0 Relevance: 6.0, APIs: 4, Instructions: 29synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,00002710,00000000,11069A9E,110313F1,00000000,00000000,1106523B,0000004A,00000000,00000486,00000000), ref: 1109C7D3
SetEvent.KERNEL32(?), ref: 1109C7D9
WaitForSingleObject.KERNEL32(?,00002710), ref: 1109C7E8
CloseHandle.KERNEL32(?), ref: 1109C7EE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ObjectSingleWait$CloseEventHandle
String ID:
API String ID: 1408678129-0
Opcode ID: cd81ba92b0467613381c6496d1761757c67ff5ece54a56296118104515409127
Instruction ID: 48269262502208b4049c7744cc901bffde1349873c1eb30b453005ae5f788441
Opcode Fuzzy Hash: cd81ba92b0467613381c6496d1761757c67ff5ece54a56296118104515409127
Instruction Fuzzy Hash: 69F05E35A007509BD320DB7DC898A1BF7E9BF9C710B14C91DE69AD3690C6B1F440CB61

Function 111107B0 Relevance: 6.0, APIs: 4, Instructions: 26COMMON

Download Yara Rule

APIs

LoadCursorA.USER32(00000000,00007F00), ref: 111107C2
SetCursor.USER32(00000000,?,1111D6AD), ref: 111107C9
DestroyCursor.USER32(?), ref: 111107E0
DestroyCursor.USER32(?), ref: 111107ED

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Cursor$Destroy$Load
String ID:
API String ID: 3167891023-0
Opcode ID: 3e762f69ea2f866378f3aa8a729baee8aa38abc9c96ed949449feaaded428a04
Instruction ID: 5d8322599005a43f93f1fe230d4de7ede423d5d2b50fc2b22cc9a4f0cfafb1d1
Opcode Fuzzy Hash: 3e762f69ea2f866378f3aa8a729baee8aa38abc9c96ed949449feaaded428a04
Instruction Fuzzy Hash: E3E0ED70A05B119BEB128B798DCC95AF7E9ABC4611B604A29E5AEC2508CB35A8418B20

Function 110071E5 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

CreateWindowExA.USER32(00000000,edit,00000000,40040004,?,?,?,?,?,00000002,00000000,?), ref: 11007337
SetFocus.USER32(?), ref: 11007393

Strings

edit, xrefs: 11007331

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateFocusWindow
String ID: edit
API String ID: 1248327856-2167791130
Opcode ID: bd565bce85dd4f0762bbccad1504e61c0c9821c93bda5e65346c20b5353e1787
Instruction ID: 0295e988d5852a3d3e470357d5a3beca780f6b3ed726ed28e80dda3c5c52f466
Opcode Fuzzy Hash: bd565bce85dd4f0762bbccad1504e61c0c9821c93bda5e65346c20b5353e1787
Instruction Fuzzy Hash: 6651B1B6A00606AFE741CF64DC80BABB7E5FB88354F11856DF995C7340EA34A942CB60

Function 110BD2B0 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 130comCOMMON

Download Yara Rule

APIs

Part of subcall function 110756C0: GlobalAddAtomA.KERNEL32(NSMCoolbar), ref: 11075715
Part of subcall function 110756C0: GetSysColor.USER32 ref: 11075733
Part of subcall function 110756C0: GetSysColor.USER32(00000014), ref: 1107573A
Part of subcall function 110756C0: GetSysColor.USER32(00000010), ref: 11075741
Part of subcall function 110756C0: GetSysColor.USER32(00000008), ref: 11075748
Part of subcall function 110756C0: GetSysColor.USER32(00000016), ref: 1107574F

Part of subcall function 110AE4E0: InitializeCriticalSection.KERNEL32(00000154,00000000,110BD382,D68DEC44,00000000,00000000,00000000,00000000,00000000,11181574,000000FF,?,1105D0EF,?), ref: 110AE4F1

Part of subcall function 1110D640: GetCurrentThreadId.KERNEL32 ref: 1110D6D6
Part of subcall function 1110D640: InitializeCriticalSection.KERNEL32(-00000010,?,000000FF,?,1100C944,00000001,?), ref: 1110D6E9
Part of subcall function 1110D640: InitializeCriticalSection.KERNEL32(111EB518,?,000000FF,?,1100C944,00000001,?), ref: 1110D6F8
Part of subcall function 1110D640: EnterCriticalSection.KERNEL32(111EB518,?,000000FF,?,1100C944), ref: 1110D70C
Part of subcall function 1110D640: CreateEventA.KERNEL32(00000000,00000000,00000000,00000000,?,000000FF,?,1100C944), ref: 1110D732

OleInitialize.OLE32(00000000), ref: 110BD412

Part of subcall function 110CA0C0: InterlockedIncrement.KERNEL32(111E1E04), ref: 110CA0C8
Part of subcall function 110CA0C0: CoInitialize.OLE32(00000000), ref: 110CA0EC

GlobalAddAtomA.KERNEL32(NSMCobrowse), ref: 110BD465

Strings

NSMCobrowse, xrefs: 110BD460

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ColorInitialize$CriticalSection$AtomGlobal$CreateCurrentEnterEventIncrementInterlockedThread
String ID: NSMCobrowse
API String ID: 2361268844-2243205248
Opcode ID: 88dc073a5fc487448423a3187bcd4f975cd28c6ebfe2e750eb1d7b69bbba14dc
Instruction ID: 442d6c63181205db1d55281eaa04c4f14a329a35af200f9554f8beddd21df20a
Opcode Fuzzy Hash: 88dc073a5fc487448423a3187bcd4f975cd28c6ebfe2e750eb1d7b69bbba14dc
Instruction Fuzzy Hash: 9A513578800785DFD720CFA9C59479EFBE4BF19308F50896ED4AA83241DB74B604CB66

Function 11009230 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 116COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110092A5
_memmove.LIBCMT ref: 110092F6

Part of subcall function 11008D90: std::_Xinvalid_argument.LIBCPMT ref: 11008DAA

Strings

string too long, xrefs: 110092A0

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_$_memmove
String ID: string too long
API String ID: 2168136238-2556327735
Opcode ID: 711012aa8f80d6622edea3fc643ca364f1e1d787b744125ac96ef8017c63f205
Instruction ID: fb38799dae4a6f564bd0abfbe08d2a9ce624c7080fcd0a86264fbe5616fb089d
Opcode Fuzzy Hash: 711012aa8f80d6622edea3fc643ca364f1e1d787b744125ac96ef8017c63f205
Instruction Fuzzy Hash: 4531C932B146108BF324DE9CE88099EFBEDEB957A4B10492BE599C7640E7719C4087A1

Function 1101F7A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 93COMMON

Download Yara Rule

APIs

DeleteObject.GDI32(?), ref: 1101F8B4

Part of subcall function 1115B900: SetPropA.USER32(00000000,00000000), ref: 1115B91E
Part of subcall function 1115B900: SetWindowLongA.USER32(00000000,000000FC,1115B310), ref: 1115B92F

Part of subcall function 1115A810: SetPropA.USER32(?,?,?), ref: 1115A865

Strings

OnDestroy - delete m_WBFrameWnd, xrefs: 1101F87A
Chat Window Destroyed, xrefs: 1101F7CB

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Prop$DeleteLongObjectWindow
String ID: Chat Window Destroyed$OnDestroy - delete m_WBFrameWnd
API String ID: 2163963939-4047192309
Opcode ID: f5209c8029e57aa5231aa12c47dc93b919d580d10e54cd5b01dac034bcb139b2
Instruction ID: 357e7f37f5d1668d2d07dc2edee483e192774d68a0bc5090a5415c9fc3bded88
Opcode Fuzzy Hash: f5209c8029e57aa5231aa12c47dc93b919d580d10e54cd5b01dac034bcb139b2
Instruction Fuzzy Hash: 583107B5A00605ABE740CF64D880F6FF7B6EF85B18F14462CE86957390DB75B801CB92

Function 111431A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 82windowCOMMON

Download Yara Rule

APIs

FormatMessageA.KERNEL32(00000400,?,00000000,00000000,1110F828,00000401,?,?,00000000,1110F828), ref: 1114322B
wvsprintfA.USER32(1110F828,?,?), ref: 11143242

Strings

ERROR TOO LONG: fmt_string=<%s>, s=<%.80s>, xrefs: 1114325A

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: FormatMessagewvsprintf
String ID: ERROR TOO LONG: fmt_string=<%s>, s=<%.80s>
API String ID: 65494530-3330918973
Opcode ID: c25eacbd0b428038e7478bb12280b47ff116fe7503ede9e4e9cfe6766b64c3e9
Instruction ID: 7b8c21f0d47ae5b8d4432e3c6643be847014a77ef3b9ea8798306e4929057a0c
Opcode Fuzzy Hash: c25eacbd0b428038e7478bb12280b47ff116fe7503ede9e4e9cfe6766b64c3e9
Instruction Fuzzy Hash: 3E21E6B1D14269AAD710CB94CC80FEFFBBCEB44614F0041A9F61993240D7346A44CBA1

Function 110DC4E0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 81COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110DC4F4

Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C758
Part of subcall function 1115C743: __CxxThrowException@8.LIBCMT ref: 1115C76D
Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C77E

std::_Xinvalid_argument.LIBCPMT ref: 110DC503

Strings

string too long, xrefs: 110DC4EF, 110DC4FE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 9bf287391914c68da6f405f3e6a98fe650d31aba90c748f2b491c328c8375671
Instruction ID: d5bf4f74dc9e3335421522f93208ef282dbf2cc105bfbce26c106abeb59e91c6
Opcode Fuzzy Hash: 9bf287391914c68da6f405f3e6a98fe650d31aba90c748f2b491c328c8375671
Instruction Fuzzy Hash: 1321C536B047508BDB22CE5C990069AFBE8DF97630F904A9FE5E5CB251C671D88087A1

Function 1104A020 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

#10.WSOCK32(00000000,?,05685620), ref: 1104A0E1
_free.LIBCMT ref: 1104A0E9

Strings

>, xrefs: 1104A062

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID: >
API String ID: 269201875-325317158
Opcode ID: a3c057ea881e87e50144fc06fa31e79cf96ad6e629eb4023414f332ed104dd0d
Instruction ID: 82a529d53c649dcc984f7a9cd07603b69fc873af2d567b1af03b9ffd8975d37a
Opcode Fuzzy Hash: a3c057ea881e87e50144fc06fa31e79cf96ad6e629eb4023414f332ed104dd0d
Instruction Fuzzy Hash: B721B638D0025A8BDB51DF28C8507D9B7F4BF0A314F5484D9E9C9DB241DE356A89CB91

Function 1100F590 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 76COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 1100F5AB

Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C758
Part of subcall function 1115C743: __CxxThrowException@8.LIBCMT ref: 1115C76D
Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C77E

std::_Xinvalid_argument.LIBCPMT ref: 1100F5C2

Strings

string too long, xrefs: 1100F5A6, 1100F5BD

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Xinvalid_argumentstd::_std::exception::exception$Exception@8Throw
String ID: string too long
API String ID: 963545896-2556327735
Opcode ID: 69122bec0b5c6146de6e2d53f554e1f5589db86b934e6a528e2b678edb9c8a85
Instruction ID: 8a11f1af5fd30639e69df00cf7b6fea6612f3362406439569cf3c7dfac817c12
Opcode Fuzzy Hash: 69122bec0b5c6146de6e2d53f554e1f5589db86b934e6a528e2b678edb9c8a85
Instruction Fuzzy Hash: 4011D633704A105FE321DE6CEC80BAAF7EDEF956B4F10065FE69687650C761A90087A1

Function 110DE1C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 11008D90: std::_Xinvalid_argument.LIBCPMT ref: 11008DAA

OutputDebugStringA.KERNEL32(?,000000FF,NsAppSystem::CNsAsException::CNsAsException,0000002B,?,00000000,000000FF,D68DEC44,?,00000000,00000000,?,?,?,00000000,1118404B), ref: 110DE273
OutputDebugStringA.KERNEL32(1119A1A8,?,?,?,00000000,1118404B,000000FF,?,110DB7A3,?,Invalid Server paramters), ref: 110DE27A

Strings

NsAppSystem::CNsAsException::CNsAsException, xrefs: 110DE21D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DebugOutputString$Xinvalid_argumentstd::_
String ID: NsAppSystem::CNsAsException::CNsAsException
API String ID: 3978508687-500537696
Opcode ID: aad5593be4273f2356cf8fa7ed492aff273016a87c1537dc76a97c77e590ef19
Instruction ID: 38b7eb13dca9dcd174f09e85a5be054518d8d746cbd5c323fe579c929207a573
Opcode Fuzzy Hash: aad5593be4273f2356cf8fa7ed492aff273016a87c1537dc76a97c77e590ef19
Instruction Fuzzy Hash: 9F21A075D04349AFCB10DFA9C880BEEFBB4EF45714F10822ED42567280D7756A45CBA1

Function 11143700 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 75COMMON

Download Yara Rule

APIs

Part of subcall function 111401E0: GetCurrentProcess.KERNEL32(00000000,?,11140433,?), ref: 111401EC
Part of subcall function 111401E0: GetModuleFileNameA.KERNEL32(00000000,111EB880,00000104,?,11140433,?), ref: 11140209

_memmove.LIBCMT ref: 11143771

Strings

Failed to get callstack, xrefs: 1114371D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CurrentFileModuleNameProcess_memmove
String ID: Failed to get callstack
API String ID: 4135527288-766476014
Opcode ID: 7a94fb7353285a655a06e7a633ebb60d7ecd06214552a4a1501fd4c32f17cb75
Instruction ID: e6839c0424cd1486d520d745e592d564cb72b657b5fd92c200d33ad71f67133a
Opcode Fuzzy Hash: 7a94fb7353285a655a06e7a633ebb60d7ecd06214552a4a1501fd4c32f17cb75
Instruction Fuzzy Hash: A7218375A0011A9BCB54DF64DC84BAEF7B4EF48718F1441AAEC1DA7780EB31AE448B90

Function 11141380 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 73COMMON

Download Yara Rule

APIs

ExpandEnvironmentStringsA.KERNEL32(?,?,00000104,001D9CC0), ref: 111413A7
GetModuleFileNameA.KERNEL32(00000000,?,00000104), ref: 111413E6

Strings

:, xrefs: 111413BB

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: EnvironmentExpandFileModuleNameStrings
String ID: :
API String ID: 2034136378-336475711
Opcode ID: 898a0503c4b53dd87ffe99c83121ebbf96a489695f23966b282f3c8bd7bbbcac
Instruction ID: 9e248f07422dcc83f84c7271cebe3bfc6726a70904aa835a4c4a48ce180bfef5
Opcode Fuzzy Hash: 898a0503c4b53dd87ffe99c83121ebbf96a489695f23966b282f3c8bd7bbbcac
Instruction Fuzzy Hash: D2216474E083599BDB12CF68CC44BD9FB685F01B08F1481D8E59897582EF70B688CBA2

Function 11031310 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 72COMMON

Download Yara Rule

APIs

GetVersion.KERNEL32(D68DEC44,00000000,1106FA4F,?,11186EFB,000000FF,?,11065185,NSMWClass,D68DEC44,?,11069A9E,00000000,?,1106FA4F,00000000), ref: 1103134A

Part of subcall function 11031250: LoadLibraryA.KERNEL32(Kernel32.dll,D68DEC44,D68DEC44,11069A9E,?,?,?,?,?,?,?,?,?,?,00000000,1117B7D8), ref: 11031282
Part of subcall function 11031250: GetCurrentProcessId.KERNEL32(?,?,?,?,?,?,?,?,?,00000000,1117B7D8,000000FF,?,1103135B,?,11065185), ref: 110312C0
Part of subcall function 11031250: GetProcAddress.KERNEL32(00000000,ProcessIdToSessionId), ref: 110312CE
Part of subcall function 11031250: FreeLibrary.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,00000000,1117B7D8,000000FF,?,1103135B), ref: 110312F4

Strings

NSMWClass, xrefs: 1103135F
NSMWClassVista, xrefs: 1103138F, 11031394, 110313B8

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Library$AddressCurrentFreeLoadProcProcessVersion
String ID: NSMWClass$NSMWClassVista
API String ID: 3451282406-889775840
Opcode ID: c1d82182b110200ff74f1ca18f720d4cc2651503a71f51dd6ea1e91b1df8269a
Instruction ID: 782afd792b29639a9ee38f980fe56c745aae8b38eeca773676e0dd0556e57061
Opcode Fuzzy Hash: c1d82182b110200ff74f1ca18f720d4cc2651503a71f51dd6ea1e91b1df8269a
Instruction Fuzzy Hash: B621E471E282855FD701CF2889407AAFBFAEB8A755F44C9A9E895D7B80F732D404C790

Function 110EB420 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 62registryCOMMON

Download Yara Rule

APIs

RegQueryValueExA.ADVAPI32(?,?,00000000,?,?,?), ref: 110EB450

Part of subcall function 110EB110: wvsprintfA.USER32(?,?,?), ref: 110EB13B

Strings

(, xrefs: 110EB449
Error %d getting %s, xrefs: 110EB464

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: QueryValuewvsprintf
String ID: ($Error %d getting %s
API String ID: 141982866-3697087921
Opcode ID: 87b2b927ab1768e65d682e087edafb2dd0fb04e5305c38559ea9cbd7fd318d97
Instruction ID: 04de767459127587aaaf4838f159857f57f90d110ff7bfd1365b741cb46ba35a
Opcode Fuzzy Hash: 87b2b927ab1768e65d682e087edafb2dd0fb04e5305c38559ea9cbd7fd318d97
Instruction Fuzzy Hash: 1711A3B6E02118AFDB40DE99D885EEEF3B8EB85614F10856AF815A7140EA31AA04C771

Function 11110580 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 53COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 111105E3

Strings

..\ctl32\Remote.cpp, xrefs: 111105C4
nbytes <= sizeof (buf), xrefs: 111105C9

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: ..\ctl32\Remote.cpp$nbytes <= sizeof (buf)
API String ID: 4104443479-3667431857
Opcode ID: 7e96671243ea38bd10bafd802c126586f9795bf2fa096f0a64b3368a2dec637f
Instruction ID: ee5b09cdc1763920a562a48ff9ac435fb49aee12072dc9f6ee001c20ac5b0fa0
Opcode Fuzzy Hash: 7e96671243ea38bd10bafd802c126586f9795bf2fa096f0a64b3368a2dec637f
Instruction Fuzzy Hash: 2D019E35F01119AB8750DAA8EC419AEF3A9EB84618F41446AEC0D97241EA30AA1086A1

Function 110E8150 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutA.USER32(?,0000004A,00000000,000006CE,00000002,00001388,?), ref: 110E81EE

Strings

IsA(), xrefs: 110E8188, 110E81B5
e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h, xrefs: 110E8183, 110E81B0

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSendTimeout
String ID: IsA()$e:\nsmsrc\nsm\1210\1210f\ctl32\DataStream.h
API String ID: 1599653421-2270926670
Opcode ID: 03aa57706c3c102c9eef86b76d8f3b204f04c441000c67825607d7dd9cb2c7f7
Instruction ID: 5fb7b2b94a517f204a6ab8f0605dc9b8b9e5128bdb2356230d1ab0ac3e6f91c7
Opcode Fuzzy Hash: 03aa57706c3c102c9eef86b76d8f3b204f04c441000c67825607d7dd9cb2c7f7
Instruction Fuzzy Hash: 6E11A579B01616AFDB00DF99DC45FDDF3F9AF88704F008199E659A7281E7717A008B92

Function 11063260 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 52COMMON

Download Yara Rule

APIs

CreateEventA.KERNEL32(00000000,00000001,00000000,00000000,D68DEC44,?,?,00000000,00000000,1117DBA8,000000FF,?,1107057F,00000000), ref: 110632BE

Strings

..\ctl32\Connect.cpp, xrefs: 110632D0
event, xrefs: 110632D5

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateEvent
String ID: ..\ctl32\Connect.cpp$event
API String ID: 2692171526-397488498
Opcode ID: 125111c4d902fdf5aefa25cb4068497dcfc462e1d5114a7a1221f35ab274d45a
Instruction ID: 7769229036d9d6174d7867bb749ab245ae6e8ccf3561f77f00046cbf2e87bb1f
Opcode Fuzzy Hash: 125111c4d902fdf5aefa25cb4068497dcfc462e1d5114a7a1221f35ab274d45a
Instruction Fuzzy Hash: 7911CEB5A00B05AFC720DF19CC41B5AF7E8EB44714F00862EE825A7780D7B5A5048B90

Function 1105B740 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52threadCOMMON

Download Yara Rule

APIs

Part of subcall function 110756C0: GlobalAddAtomA.KERNEL32(NSMCoolbar), ref: 11075715
Part of subcall function 110756C0: GetSysColor.USER32 ref: 11075733
Part of subcall function 110756C0: GetSysColor.USER32(00000014), ref: 1107573A
Part of subcall function 110756C0: GetSysColor.USER32(00000010), ref: 11075741
Part of subcall function 110756C0: GetSysColor.USER32(00000008), ref: 11075748
Part of subcall function 110756C0: GetSysColor.USER32(00000016), ref: 1107574F

GlobalAddAtomA.KERNEL32(NSMReplayWin), ref: 1105B7A1
GetCurrentThreadId.KERNEL32 ref: 1105B7C7

Strings

NSMReplayWin, xrefs: 1105B798

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Color$AtomGlobal$CurrentThread
String ID: NSMReplayWin
API String ID: 3170584694-3134019838
Opcode ID: c7ee01bedf1346b4ebaab1a364cd98bc4754d3e72808af840d12c909b7d32de3
Instruction ID: f44999c9253cc2037c09fe9953b76a1f707b8109e5199ada52e5b8e66c48ef20
Opcode Fuzzy Hash: c7ee01bedf1346b4ebaab1a364cd98bc4754d3e72808af840d12c909b7d32de3
Instruction Fuzzy Hash: DE113A75A04659AFC700CF99C880B9AFBA8FB08614F50862EE86997740D735B900CBA4

Function 11019330 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 51COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 11019345

Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C758
Part of subcall function 1115C743: __CxxThrowException@8.LIBCMT ref: 1115C76D
Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C77E

_memmove.LIBCMT ref: 11019374

Strings

vector<T> too long, xrefs: 11019340

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 83413834b9b8fbd614b04002deb0ac44b0a2f778865e3d023030443bc5ad862d
Instruction ID: a4f97cebd27cb236831cf372360440aa0146846f8d4a25bc5e69f896e8856cfd
Opcode Fuzzy Hash: 83413834b9b8fbd614b04002deb0ac44b0a2f778865e3d023030443bc5ad862d
Instruction Fuzzy Hash: 1301B5B1A012069FC724CEADDC80CA7F3D9EB94318315CA2DE4AAC7644EA74F904C790

Function 110DE7F0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

std::_Xinvalid_argument.LIBCPMT ref: 110DE805

Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C758
Part of subcall function 1115C743: __CxxThrowException@8.LIBCMT ref: 1115C76D
Part of subcall function 1115C743: std::exception::exception.LIBCMT ref: 1115C77E

_memmove.LIBCMT ref: 110DE830

Strings

vector<T> too long, xrefs: 110DE800

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: std::exception::exception$Exception@8ThrowXinvalid_argument_memmovestd::_
String ID: vector<T> too long
API String ID: 1785806476-3788999226
Opcode ID: 4eb4cbeb7a2f61f3fec2fb68e10f8a42d932404c5743c152ad98019516bc48e3
Instruction ID: cf58d3f33603e97c4f24b664994154c3d25a3521c31f76394b3dd8d3ba202d92
Opcode Fuzzy Hash: 4eb4cbeb7a2f61f3fec2fb68e10f8a42d932404c5743c152ad98019516bc48e3
Instruction Fuzzy Hash: 9A015275A017169FDB14CE6DDC808ABB7E9EB846183148A3DE4AA87644EA70F8048790

Function 1100B5F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 47COMMON

Download Yara Rule

Strings

Error. preventing capbuf overflow, xrefs: 1100B626
Error. NULL capbuf, xrefs: 1100B601

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID:
String ID: Error. NULL capbuf$Error. preventing capbuf overflow
API String ID: 0-3856134272
Opcode ID: 05b361dad69bf5257632ef7833a00ccf2d2e64f05d49bd7a40a08eeeead0cf8c
Instruction ID: c6ab0f1f7e392b353a36295ea23dfd47864b574d32320fb314f97485872e3e0a
Opcode Fuzzy Hash: 05b361dad69bf5257632ef7833a00ccf2d2e64f05d49bd7a40a08eeeead0cf8c
Instruction Fuzzy Hash: 26012BBEA0060997D710CE65FC40ADBB3A8DB8437CF04883AEA1D83502E274B5D18696

Function 11015010 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 40windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001006,00000000,?), ref: 1101507D

Strings

m_hWnd, xrefs: 11015029
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11015024

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 3850602802-3966830984
Opcode ID: 443af1fe9e4cf7375442eec229f81973e691e2c2fb5f7496263955d6c1fbdae8
Instruction ID: bce7b4153dfc7b4fd076b8ceb5e4e8bca41d26a2ce69ee5182543e203c2991a2
Opcode Fuzzy Hash: 443af1fe9e4cf7375442eec229f81973e691e2c2fb5f7496263955d6c1fbdae8
Instruction Fuzzy Hash: A70184B1D11219AFCB90DFA9C845BDEBBF4EB0C310F14816AE518F7240E7755A808B95

Function 11014350 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 36COMMON

Download Yara Rule

APIs

ImageList_Create.COMCTL32(?,?,?,?,?), ref: 1101437E

Strings

..\ctl32\imagelst.cpp, xrefs: 1101438C
m_hImageList, xrefs: 11014391

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateImageList_
String ID: ..\ctl32\imagelst.cpp$m_hImageList
API String ID: 1626615151-1731862680
Opcode ID: dec3c48ceb2352190073a142a500cca9cc3499ef2600fae3eaa8bcb01c721d26
Instruction ID: acac1cc562ef414c488f1e800a9ab72297ccb9dc64e06fd76f2a1ec1e0a85bbc
Opcode Fuzzy Hash: dec3c48ceb2352190073a142a500cca9cc3499ef2600fae3eaa8bcb01c721d26
Instruction Fuzzy Hash: FAF06DB560031AAFC320CF59D845A97B7E8EF98320B00C82DF999C3200E374E850CFA0

Function 11029409 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 35COMMON

Download Yara Rule

APIs

_strrchr.LIBCMT ref: 11029435
ExitProcess.KERNEL32 ref: 11029474

Strings

Info. assert, restarting..., xrefs: 1102945D

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ExitProcess_strrchr
String ID: Info. assert, restarting...
API String ID: 2988203065-19348290
Opcode ID: 56eb71fcb290c2eac8491721ebda1c562eda405397dc8281640ef8180663ead1
Instruction ID: e324632a4a616e14dd7ea1be9d5e2d09631ca5cb74204e3141af8daf442ce2f6
Opcode Fuzzy Hash: 56eb71fcb290c2eac8491721ebda1c562eda405397dc8281640ef8180663ead1
Instruction Fuzzy Hash: 85F09674A41222AFF351DFE4CC81F3A7BA4BB4970CF144065E628962C6E771A401CBA2

Function 1109C270 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(00000000,ConvertStringSecurityDescriptorToSecurityDescriptorA), ref: 1109C284
SetLastError.KERNEL32(00000078,00000000,?,1109D12C,S:(ML;;NW;;;LW),00000001,?,00000000,?,00000000), ref: 1109C2AD

Strings

ConvertStringSecurityDescriptorToSecurityDescriptorA, xrefs: 1109C27E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: ConvertStringSecurityDescriptorToSecurityDescriptorA
API String ID: 199729137-262600717
Opcode ID: daef23f5b680dd349aa9a2bcfdfcc8cc6635a85109e2b0454d5b0b8cdc6ba655
Instruction ID: 74ad0d5ca9065b7f4703d6727b9db8ed8064f0d958acfef4e63603f2a78fde4f
Opcode Fuzzy Hash: daef23f5b680dd349aa9a2bcfdfcc8cc6635a85109e2b0454d5b0b8cdc6ba655
Instruction Fuzzy Hash: 95F08276A01229AFD324CFE8E944F97B7E8EB48751F00492AF949D7240C670E810CBB1

Function 11027770 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 32libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,InternetReadFile), ref: 11027784
SetLastError.KERNEL32(00000078), ref: 110277AD

Strings

InternetReadFile, xrefs: 1102777E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: InternetReadFile
API String ID: 199729137-1824561397
Opcode ID: bce7183f882b404d0244c74e1412e04578b3085351b3403441cca5baeca090ef
Instruction ID: f72fc716f5145c5c62a3bd185c87cc271c68250e6f305f0ea9dbb341289ac841
Opcode Fuzzy Hash: bce7183f882b404d0244c74e1412e04578b3085351b3403441cca5baeca090ef
Instruction Fuzzy Hash: 20F08276A00628AFD310CF99E844E9BB7E8FF48711F40841AF94597640C770F810CFA0

Function 11087770 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 32COMMON

Download Yara Rule

APIs

Part of subcall function 1110CC30: GetCurrentThreadId.KERNEL32 ref: 1110CC3E
Part of subcall function 1110CC30: EnterCriticalSection.KERNEL32(00000000,00000000,00000000,111EB1BC,?,110CC8D4,00000000,D68DEC44,00000000), ref: 1110CC48
Part of subcall function 1110CC30: LeaveCriticalSection.KERNEL32(00000000,11116B8B,00000000,?,110CC8D4,00000000,D68DEC44,00000000), ref: 1110CC68

InterlockedIncrement.KERNEL32(00000000), ref: 110877C1

Part of subcall function 1110D0E0: GetCurrentThreadId.KERNEL32 ref: 1110D109
Part of subcall function 1110D0E0: EnterCriticalSection.KERNEL32(00000000,?,1106F947,00000001,?), ref: 1110D116
Part of subcall function 1110D0E0: LeaveCriticalSection.KERNEL32(00000000,?,?,?,1106F947), ref: 1110D162

Part of subcall function 11087690: InterlockedDecrement.KERNEL32(00000000), ref: 11087691

Strings

tdata, xrefs: 110877B3
..\ctl32\Errorhan.cpp, xrefs: 110877AE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CriticalSection$CurrentEnterInterlockedLeaveThread$DecrementIncrement
String ID: ..\ctl32\Errorhan.cpp$tdata
API String ID: 572542348-657756363
Opcode ID: 818ce8e28e6cd5ca371826bbaac83e7adc732490b1bb7ecfed4ec679b71d7d5c
Instruction ID: 6dac07193623e5f2632b547c5dec7303e3bc74853b552a110c500cb1758fa17c
Opcode Fuzzy Hash: 818ce8e28e6cd5ca371826bbaac83e7adc732490b1bb7ecfed4ec679b71d7d5c
Instruction Fuzzy Hash: 9BE0653EE02A2723D122A5E55C14F9FFA481F8569CB84D050EF14AB284EC10685143F3

Function 11075330 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 31COMMON

Download Yara Rule

APIs

DeferWindowPos.USER32(8B000E7E,00000000,78E85BC0,33CD335E,?,00000000,33CD335E,11076086), ref: 11075373

Strings

m_hWnd, xrefs: 11075346
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11075341

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DeferWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3419921934-2830328467
Opcode ID: fca648fd2a5da0a923569919eadd23a1ec12eaeccd38e426ac2979543d2cf477
Instruction ID: 1994835ecc7f51f8c10b9716208061b8583218301434d53217714c2094a20470
Opcode Fuzzy Hash: fca648fd2a5da0a923569919eadd23a1ec12eaeccd38e426ac2979543d2cf477
Instruction Fuzzy Hash: 2CF0F2B661021AABC704DE89EC80EEBB3ECAB88354F04C119FA1993250D674E850CBA0

Function 110151C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,0000102D,00000000,?), ref: 11015209

Strings

m_hWnd, xrefs: 110151D9
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110151D4

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 3850602802-3966830984
Opcode ID: 6d302ea717c43ad62476d714418c3f3a3f9cc1fc9bde59d676a2d89626abd4a8
Instruction ID: 03be081aaf5f5e559ce7db0dd7575c21a4092ed3e1d7c8873e6b3f428640d709
Opcode Fuzzy Hash: 6d302ea717c43ad62476d714418c3f3a3f9cc1fc9bde59d676a2d89626abd4a8
Instruction Fuzzy Hash: 2FF0FE75E0021EABC714DF95DC45DDAB7F8EB4C310F00861AFD15A7280D770A950CBA1

Function 11029060 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 29threadCOMMON

Download Yara Rule

APIs

Part of subcall function 1105D1B0: __wcstoi64.LIBCMT ref: 1105D1ED

CreateThread.KERNEL32(00000000,00000000,Function_00026DF0,00000000,00000000,?), ref: 110290AE

Strings

*TapiFixPeriod, xrefs: 11029077
Bridge, xrefs: 1102907C

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CreateThread__wcstoi64
String ID: *TapiFixPeriod$Bridge
API String ID: 1152747075-2058455932
Opcode ID: a3a0c583c9821bd13ae1b566ac1fc4b97b1e8fff2f2f284b2f88db20dcaa388a
Instruction ID: 24c450593d9a31589b3aea6a549a629711e635f1a7c65752e95f2e88d1da8d95
Opcode Fuzzy Hash: a3a0c583c9821bd13ae1b566ac1fc4b97b1e8fff2f2f284b2f88db20dcaa388a
Instruction Fuzzy Hash: ECF06530A8021DBFF361CAD1CC91F75B694A30074CF500179FA25A91C4E7A96D008795

Function 110311C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,ProcessIdToSessionId), ref: 110311D4
SetLastError.KERNEL32(00000078), ref: 110311F5

Strings

ProcessIdToSessionId, xrefs: 110311CE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: ProcessIdToSessionId
API String ID: 199729137-2164408197
Opcode ID: 0989fa0eae9447a83203c656f489c30663d8326983daade6a998f5e1f9ae4752
Instruction ID: e784d236a41cf751667e7cb2d7edaf0e8f7d6e11bc79799c7afc82c171669e28
Opcode Fuzzy Hash: 0989fa0eae9447a83203c656f489c30663d8326983daade6a998f5e1f9ae4752
Instruction Fuzzy Hash: E7E06532A502289FC310DFA9D844A97F7E8EB58762F00852AE95597600C670A801CFA0

Function 11157050 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetWindowTextLengthA.USER32(001D9D4E), ref: 11157053
GetWindowTextA.USER32(001D9D4E,00000000,00000001), ref: 1115706D

Strings

..., xrefs: 1115707B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: TextWindow$Length
String ID: ...
API String ID: 1006428111-1685331755
Opcode ID: 4dc81bbcc1d34def4cc0ce9054a55d1dd6e91212972db4f8fe389287d5e4eece
Instruction ID: 04571b80a45a67fc605ae95ec5d69cb5d5bf03e21c2b28fc48b2b75dc2d30835
Opcode Fuzzy Hash: 4dc81bbcc1d34def4cc0ce9054a55d1dd6e91212972db4f8fe389287d5e4eece
Instruction Fuzzy Hash: 55E0927A9046675FD2414639AD48DCBFB9DEF87218B459470F195D7205EA20E80E87E0

Function 110145E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 27windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001003,?,00000000), ref: 1101461E

Strings

m_hWnd, xrefs: 110145F6
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110145F1

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 3850602802-3966830984
Opcode ID: 484bb23c668ff2b466f0dd54c6b9d55862a76d0bc716c246a02728fce9eb96d6
Instruction ID: 116081e33e878121fd85daa82257ccb75d1af11bcf9b564ed2347b4fc78382e6
Opcode Fuzzy Hash: 484bb23c668ff2b466f0dd54c6b9d55862a76d0bc716c246a02728fce9eb96d6
Instruction Fuzzy Hash: 0AE0D831B00225EFD310EA55DC40FC773DCAB48755F018425F918CB194DBB0E8408751

Function 1101D240 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,FlashWindowEx), ref: 1101D254
SetLastError.KERNEL32(00000078), ref: 1101D271

Strings

FlashWindowEx, xrefs: 1101D24E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: FlashWindowEx
API String ID: 199729137-2859592226
Opcode ID: 6eb3ecd10c9fae1572f4625296235db4504534210700a3559b91c9200f8acfa4
Instruction ID: 11f0c42be7fd5221fd4a00164af4785d43a9d2980b51484210af3b2476814cf3
Opcode Fuzzy Hash: 6eb3ecd10c9fae1572f4625296235db4504534210700a3559b91c9200f8acfa4
Instruction Fuzzy Hash: A0E06D32A012349FC320AEA9A848A8AF7E8DB18721F00442AEA559B104C635E8408BA0

Function 110277C0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 26libraryloaderCOMMON

Download Yara Rule

APIs

GetProcAddress.KERNEL32(?,InternetCloseHandle), ref: 110277D4
SetLastError.KERNEL32(00000078), ref: 110277F1

Strings

InternetCloseHandle, xrefs: 110277CE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: AddressErrorLastProc
String ID: InternetCloseHandle
API String ID: 199729137-3843628324
Opcode ID: 1ac16273544bbe1a851df50f4dee5b44b6f31d91f53cecc24f5b33e5bb1b8777
Instruction ID: afadf18f26519b45d4ec41401a7ae7218e626ac7fc357e568b723cb3eca83cf8
Opcode Fuzzy Hash: 1ac16273544bbe1a851df50f4dee5b44b6f31d91f53cecc24f5b33e5bb1b8777
Instruction Fuzzy Hash: 1EE01272A416289BC330DFA9D844A46F7E8EF25761F10456BEA4597501DA70A454CBE0

Function 11001090 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25windowCOMMON

Download Yara Rule

APIs

SendDlgItemMessageA.USER32(?,?,?,?,?), ref: 110010C7

Strings

m_hWnd, xrefs: 110010A6
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010A1

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ItemMessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3015471070-2830328467
Opcode ID: a8909190e4ec99ee0d5cb0ead6ccb3350dfbde796189a051c48513391166c6c9
Instruction ID: 67c1f660e984e6e72e8e5f6b853a95cd9289e1d5cf8e7c1a2df53731270292e2
Opcode Fuzzy Hash: a8909190e4ec99ee0d5cb0ead6ccb3350dfbde796189a051c48513391166c6c9
Instruction Fuzzy Hash: FDE04875610269BFD314DE45EC40ED773DCEB48394F00C519F95597240D670E850C7B1

Function 110020A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 25COMMON

Download Yara Rule

APIs

IsWindow.USER32(?), ref: 110020AA

Strings

m_pToolbar, xrefs: 110020C5
e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h, xrefs: 110020C0

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Window
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\floatbar.h$m_pToolbar
API String ID: 2353593579-281161189
Opcode ID: ff0c2b8fa6b259e0559c209dfbe2baec66408ae9044b7edae730d2bd1be6969e
Instruction ID: 2d97705b6bdda0064d64f8dc4945d53e669e01b89870ce7254779752b9a19954
Opcode Fuzzy Hash: ff0c2b8fa6b259e0559c209dfbe2baec66408ae9044b7edae730d2bd1be6969e
Instruction Fuzzy Hash: 02E06D36B00611ABE710CA5AD880E86F3E9AF89754F054569F50893651C730EC80CB90

Function 11001050 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,?,?,?), ref: 11001083

Strings

m_hWnd, xrefs: 11001066
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001061

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3850602802-2830328467
Opcode ID: 28a180f6d98d46b5b82c32fde2a766c10bcde3d4e8ae97b09d016cbecae234fc
Instruction ID: 275f6796fb941418f1eac577f0a8e917735f6234b1641943e74a93f461fe4d50
Opcode Fuzzy Hash: 28a180f6d98d46b5b82c32fde2a766c10bcde3d4e8ae97b09d016cbecae234fc
Instruction Fuzzy Hash: 1FE08675A00369BFD310DE55DC44EDBB39CEF44365F00C019F91597240D6B0F84087A1

Function 110010E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 23windowCOMMON

Download Yara Rule

APIs

PostMessageA.USER32(?,?,?,?), ref: 11001113

Strings

m_hWnd, xrefs: 110010F6
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 110010F1

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessagePost
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 410705778-2830328467
Opcode ID: 85017124f9ec5c4c334a2e331c3e8e28cdeb6b72515053c205922204336e2776
Instruction ID: 317141b3ace0778b7fd2fa9c94edf2039d6a2fe5cb482cd995abb7f3ce7b38ec
Opcode Fuzzy Hash: 85017124f9ec5c4c334a2e331c3e8e28cdeb6b72515053c205922204336e2776
Instruction Fuzzy Hash: 2EE08675A10329BFD304DE45DC45FDBB39CEB48394F04C419FA2493240D6B0F95087A0

Function 11014170 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001201,?,?), ref: 110141A1

Strings

m_hWnd, xrefs: 11014183
e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101417E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 3850602802-3507600817
Opcode ID: 262adb9ef28025e85b7f0f394e686abdafd9072c77ea2ec77955e8e7bfc94949
Instruction ID: 300d88fcf892c058d8d0b061d339292da59dde027279cd0ab2116f43ff5b262a
Opcode Fuzzy Hash: 262adb9ef28025e85b7f0f394e686abdafd9072c77ea2ec77955e8e7bfc94949
Instruction Fuzzy Hash: B5E0CD75B10329BBD300EA41DC45FD6B39CDB44765F00C125FD1457280D670F9508790

Function 11015180 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001014,?,?), ref: 110151B4

Strings

m_hWnd, xrefs: 11015196
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11015191

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 3850602802-3966830984
Opcode ID: 8b86fa1a2162b33197e6d456e68e46081b50d097b3f32a1836dba8e2da6d9308
Instruction ID: 48da7094b8d2e2b6c354256ad2e5e38296e6604e98cd2bf0e8f8f9192e262255
Opcode Fuzzy Hash: 8b86fa1a2162b33197e6d456e68e46081b50d097b3f32a1836dba8e2da6d9308
Instruction Fuzzy Hash: F7E0C235B4136ABFE300EA41DC45ED7B3ACDB45764F00C029FE545B280D6B0F88087A1

Function 110141F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001204,?,?), ref: 11014221

Strings

m_hWnd, xrefs: 11014203
e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 110141FE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 3850602802-3507600817
Opcode ID: be2d8c906550325023109f9d6fc114afb393324ea8398dabc2d6105626153efb
Instruction ID: 0d9dd3cd63a9b9e11d5c69d9f292cba189439b28a6a4a7908e1b68aa302cb678
Opcode Fuzzy Hash: be2d8c906550325023109f9d6fc114afb393324ea8398dabc2d6105626153efb
Instruction Fuzzy Hash: E5E0C2B9B00329BFD300EA41DC45FD6B3ACDB48765F00C129FE2497280D6B0F89087A0

Function 110140F0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001203,?,?), ref: 11014121

Strings

m_hWnd, xrefs: 11014103
e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 110140FE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 3850602802-3507600817
Opcode ID: 6b5bdae9290d5d7b9bc5e6b7a3447f768c8d1291301c3a38741dc3f763d18e59
Instruction ID: 8a9049dfbee1e81fbff2faeefbc14776698c2b9d471c928ed1205f617f3babab
Opcode Fuzzy Hash: 6b5bdae9290d5d7b9bc5e6b7a3447f768c8d1291301c3a38741dc3f763d18e59
Instruction Fuzzy Hash: 20E0C2B9B00329BFD300EA51EC41FD6B3ACEB48765F00C12AFE2497281D6B0F85087A0

Function 11014740 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000101B,?,?), ref: 11014774

Strings

m_hWnd, xrefs: 11014756
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11014751

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 3850602802-3966830984
Opcode ID: 2eca408cb4b2b51e7a3e4aa9c60817eabe4bef13c3c2611bc0931c436a6538e3
Instruction ID: 1b36cda0c2f5df3b8bd88284c6b56dc8b6e2b62ebf661baec33fe6355912877d
Opcode Fuzzy Hash: 2eca408cb4b2b51e7a3e4aa9c60817eabe4bef13c3c2611bc0931c436a6538e3
Instruction Fuzzy Hash: C8E08C72A0022ABBE310EA45EC84EC3B7AC9B48364F018025FA1897281D6B0E88087A1

Function 11014630 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001003,?,?), ref: 11014664

Strings

m_hWnd, xrefs: 11014646
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11014641

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 3850602802-3966830984
Opcode ID: 5d1b1b4dceb76255abe84ebd2a5d9c577424265b3b2083f7ca580e2962024eac
Instruction ID: 28f073c9221da6f20a71dbb646e1ddf98bcb91ace6bfd7cd0ece19e606af61a2
Opcode Fuzzy Hash: 5d1b1b4dceb76255abe84ebd2a5d9c577424265b3b2083f7ca580e2962024eac
Instruction Fuzzy Hash: 52E08C35A0032ABBD310EA41EC45FD7B3ACEB48665F00C02AFE645B280D6B0B98087A1

Function 110141B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001205,00000000,?), ref: 110141DF

Strings

m_hWnd, xrefs: 110141C3
e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 110141BE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 3850602802-3507600817
Opcode ID: c57065ac21fde3432866892f07aa1457d0194b4283ccc1b452b621e616a3c870
Instruction ID: d40ca87e0003c6d1e4d5bfa61866eb0a3ae2a2f6f09e687b9debd2870884e1d0
Opcode Fuzzy Hash: c57065ac21fde3432866892f07aa1457d0194b4283ccc1b452b621e616a3c870
Instruction Fuzzy Hash: E1E02BB5F00329BBD320AA41DC05FD2B39CCB047A5F008035FB14971C0E6B1F4508794

Function 11014230 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,00001202,?,00000000), ref: 1101425F

Strings

m_hWnd, xrefs: 11014243
e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101423E

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 3850602802-3507600817
Opcode ID: 32376b9ee13e6a64c6fd2c0e4f0a4ac01c807e169ea088ab420b85b341b6e5f1
Instruction ID: 389cf7bfc4327deb45d3e9049340ee7a0bbe32fbb45df5cd1c2cf56bf95067bf
Opcode Fuzzy Hash: 32376b9ee13e6a64c6fd2c0e4f0a4ac01c807e169ea088ab420b85b341b6e5f1
Instruction Fuzzy Hash: 47E0C2B5A00329BBD310A651DC05FC6B39CCB04765F008025FB24AA1C0D6B0B8908394

Function 1101D2E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21COMMON

Download Yara Rule

APIs

MapWindowPoints.USER32(00000000,?,?,00000001), ref: 1101D30F

Strings

m_hWnd, xrefs: 1101D2F6
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D2F1

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: PointsWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 4123100037-2830328467
Opcode ID: eee121c72f6a4d454f0e079058623eff38f73df2895a17b955e35c1a351687e0
Instruction ID: 8c37537bdd7c8df9e8d0ae3f0507450a2f1c8cdb893238639b06eb277666ae53
Opcode Fuzzy Hash: eee121c72f6a4d454f0e079058623eff38f73df2895a17b955e35c1a351687e0
Instruction Fuzzy Hash: E5E02B31B00329BBD310AA41EC45FDAF38CCB00765F00C039F718565C0D5F0B88083A1

Function 11014780 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000101C,?,00000000), ref: 110147B2

Strings

m_hWnd, xrefs: 11014796
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 11014791

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 3850602802-3966830984
Opcode ID: 5aa780f51ffe857e09d66a76c69c6247e6f9e9e17097dd4b83d5d0eeb036eb7b
Instruction ID: 0b66f2fcc37735d1a52a204f9abaf30f5b56f862ecaf8adc2df9ecedebd0c714
Opcode Fuzzy Hash: 5aa780f51ffe857e09d66a76c69c6247e6f9e9e17097dd4b83d5d0eeb036eb7b
Instruction Fuzzy Hash: F2E0C235A4032ABBE320AA41DC41FD6B79C9B44760F008035FA14571C5D6B0E4808391

Function 110147C0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 21windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000101D,?,00000000), ref: 110147F2

Strings

m_hWnd, xrefs: 110147D6
e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h, xrefs: 110147D1

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\listview.h$m_hWnd
API String ID: 3850602802-3966830984
Opcode ID: 2d081154057b68fe7c927f8edffc62a61d7fab37cda1535650e03368db2db75e
Instruction ID: 884820e4dece22bd43b3449862541bfc4f36eee959ec3ffcbac70e177ab36c2a
Opcode Fuzzy Hash: 2d081154057b68fe7c927f8edffc62a61d7fab37cda1535650e03368db2db75e
Instruction Fuzzy Hash: 10E02B35B4032ABBD320E681DC45FC2B39CDB04764F008125FB14671C0D6B0F48087A1

Function 11016160 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 20windowCOMMON

Download Yara Rule

APIs

ImageList_ReplaceIcon.COMCTL32(?,000000FF,?), ref: 11016188

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h, xrefs: 1101616D
m_hImageList, xrefs: 11016172

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: IconImageList_Replace
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h$m_hImageList
API String ID: 686573685-4007669474
Opcode ID: d08a52d85985c25d67b4407f104b78c71433ecebaf87946478afdcc6aa3946e3
Instruction ID: 254988c6cbd07f6f5de5a0290186d683f5891c0224b954f64866437ca0258ea8
Opcode Fuzzy Hash: d08a52d85985c25d67b4407f104b78c71433ecebaf87946478afdcc6aa3946e3
Instruction Fuzzy Hash: 10D02B356041297FC3149E54DC00FD6B3DCCB15231F104225F964522C0DA749444C790

Function 11001120 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19COMMON

Download Yara Rule

APIs

ShowWindow.USER32(?,?), ref: 1100114B

Strings

m_hWnd, xrefs: 11001136
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001131

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: ShowWindow
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 1268545403-2830328467
Opcode ID: af1c098b4c4c80195c09b4671d03acd85b682c1fa7cbe582b2240738b11ce1de
Instruction ID: 5eb4557a27f56f27143ffdaa6a0fd65e63d6059c005b43bf75de743dbf7ac2fd
Opcode Fuzzy Hash: af1c098b4c4c80195c09b4671d03acd85b682c1fa7cbe582b2240738b11ce1de
Instruction Fuzzy Hash: 84D05E76A1033AABD324AA56EC41ED6B39C9B047A4F04802AFA2952640E671E950C7A1

Function 11001000 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 19timeCOMMON

Download Yara Rule

APIs

KillTimer.USER32(?,?), ref: 1100102B

Strings

m_hWnd, xrefs: 11001016
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 11001011

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: KillTimer
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 729406807-2830328467
Opcode ID: 9eaef6a67423154c269067f99f820217b5c52f8e10b9379536f45f79342bea5a
Instruction ID: a1c27c001084b6ca6c28b2cec64134933abdf919195d00b3164defa7453c3e74
Opcode Fuzzy Hash: 9eaef6a67423154c269067f99f820217b5c52f8e10b9379536f45f79342bea5a
Instruction Fuzzy Hash: 39D05E76A1032AABD320EA56EC44ED6B3DCEB083A4F048029FA5557680D6B1E88087A1

Function 11015560 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 18fileCOMMON

Download Yara Rule

APIs

CreateFileA.KERNEL32(\\.\NSWFPDrv,80000000,00000000,00000000,00000003,40000000,00000000), ref: 11015577
CloseHandle.KERNEL32(00000000), ref: 11015588

Strings

\\.\NSWFPDrv, xrefs: 11015572

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: CloseCreateFileHandle
String ID: \\.\NSWFPDrv
API String ID: 3498533004-85019792
Opcode ID: 3c81aefc672b3084c33de75f246b902c467d5fcc0badfe3046ef6e4ee3e93e23
Instruction ID: e44e6d3ab4a19175706417afd234c7836870768b62a23a8c5c9fc708074aaa81
Opcode Fuzzy Hash: 3c81aefc672b3084c33de75f246b902c467d5fcc0badfe3046ef6e4ee3e93e23
Instruction Fuzzy Hash: 9CD0C971A020347BE2311966AC5CFCBBD19DB027B5F310360FA2DE51D4C210495182F2

Function 11014130 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(00000000,00001200,00000000,00000000), ref: 1101415A

Strings

m_hWnd, xrefs: 11014140
e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h, xrefs: 1101413B

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MessageSend
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\headctrl.h$m_hWnd
API String ID: 3850602802-3507600817
Opcode ID: 93b55ce2bd71e4316228ec576a9f9a72c2464ad8dbd65eb86a42f4a074270db6
Instruction ID: 6ec3a86e044c0ca80b9d1e6115079c3519b8012773b6d45149078f1cc2e7fb8b
Opcode Fuzzy Hash: 93b55ce2bd71e4316228ec576a9f9a72c2464ad8dbd65eb86a42f4a074270db6
Instruction Fuzzy Hash: C7D0A975F40372AAE320A611EC0AFC5B2988B08B99F258064F220AB0C4D3A0B4808348

Function 110CE370 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 17COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 110CE39D

Strings

..\CTL32\NSMString.cpp, xrefs: 110CE387
IsA(), xrefs: 110CE38C

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: _free
String ID: ..\CTL32\NSMString.cpp$IsA()
API String ID: 269201875-3853199760
Opcode ID: 47969a5ff6162a2684b0b74e84aeb924003dfdcd1f3c9b29c0992b93a98df16f
Instruction ID: 22ebac023cf57a7d1809c6aa8a3c675c1bd7180becc87dc1259e606d2f6bf11c
Opcode Fuzzy Hash: 47969a5ff6162a2684b0b74e84aeb924003dfdcd1f3c9b29c0992b93a98df16f
Instruction Fuzzy Hash: FDD0A7BDE043621AC5D06B947C00ECDBB840B00518B0994D5F89867140EA60780089E2

Function 1115A7E0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 1115A808

Strings

m_hWnd, xrefs: 1115A7F3
..\ctl32\wndclass.cpp, xrefs: 1115A7EE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: DestroyWindow
String ID: ..\ctl32\wndclass.cpp$m_hWnd
API String ID: 3375834691-2201682149
Opcode ID: 29dbc1aecaadae7451ee1d4a5893fb8b20a9f566609fb1dac2277b90be4959b0
Instruction ID: 47d319a71810c5e54c224717a03f6bd6950a04fb2c61a5931412eb5e50f4ff72
Opcode Fuzzy Hash: 29dbc1aecaadae7451ee1d4a5893fb8b20a9f566609fb1dac2277b90be4959b0
Instruction Fuzzy Hash: D5D0A731E007229FD3605A16EC45B86B3E46B10229F158438F09652454E270B4848685

Function 110161A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14COMMON

Download Yara Rule

APIs

ImageList_GetImageCount.COMCTL32 ref: 110161BF

Strings

e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h, xrefs: 110161AA
m_hImageList, xrefs: 110161AF

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Image$CountList_
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\imagelst.h$m_hImageList
API String ID: 564719512-4007669474
Opcode ID: b424f95b68c759481728f4a840a41585183dad4684bea69f5c17ad819cbb7807
Instruction ID: 3674b751f35012ce7f363fa1ad4101e3781ab4e5f71562caa9cff9a58af02519
Opcode Fuzzy Hash: b424f95b68c759481728f4a840a41585183dad4684bea69f5c17ad819cbb7807
Instruction Fuzzy Hash: 87D08031E001369FD325EE54FC05FC5B3D86F05618F0564A9F56056145F7B858C4C751

Function 111570A0 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 111570A8
GetPropA.USER32(?,OldMenu), ref: 111570B8

Strings

OldMenu, xrefs: 111570B2

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: MenuProp
String ID: OldMenu
API String ID: 601939786-3235417843
Opcode ID: 7f044d8e329f77b17846ca3dad555fb9807e4cae4103401577cb145c9685d43a
Instruction ID: d129337c3d9c6077969ca5874e1c7494e8126f018124b9d4d07a189cb6dda97e
Opcode Fuzzy Hash: 7f044d8e329f77b17846ca3dad555fb9807e4cae4103401577cb145c9685d43a
Instruction Fuzzy Hash: FCC0123260653D7782422E559D489DEF75C9D061567008062FA14A2000E764551187FA

Function 1101D2B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 14windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(00000000), ref: 1101D2D4

Strings

m_hWnd, xrefs: 1101D2C3
e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h, xrefs: 1101D2BE

Memory Dump Source

Source File: 00000007.00000002.2139012968.0000000011001000.00000020.00000001.01000000.00000008.sdmp, Offset: 11000000, based on PE: true

Associated: 00000007.00000002.2138989474.0000000011000000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140975163.000000001118F000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2140994930.0000000011190000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141052460.00000000111DC000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141073285.00000000111E6000.00000004.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141099250.00000000111E7000.00000008.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000111F1000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011257000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001127C000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011283000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.000000001128A000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011297000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112A7000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112AD000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.00000000112D9000.00000002.00000001.01000000.00000008.sdmpDownload File
Associated: 00000007.00000002.2141321936.0000000011325000.00000002.00000001.01000000.00000008.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_11000000_client32.jbxd

Yara matches

Similarity

API ID: Menu
String ID: e:\nsmsrc\nsm\1210\1210f\ctl32\wndclass.h$m_hWnd
API String ID: 3711407533-2830328467
Opcode ID: bc8564b886251eb7b4a5a403f27ba9359a83e0f75ac04dbf5736db7d0128537c
Instruction ID: 2c483fc448afecac1cfe9dc627b91c3db1667719ca5a036d7c02360bcd0558c1
Opcode Fuzzy Hash: bc8564b886251eb7b4a5a403f27ba9359a83e0f75ac04dbf5736db7d0128537c
Instruction Fuzzy Hash: B4D01235E01736ABC310B655EC48FCAB2985B14358F0994A5F12576555E678E480C791

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify file time attributes to hide new or changes to existing files. Timestomping is a technique that modifies the timestamps of a file (the modify, access, create, and change times), often to mimic files that are in the same folder. This is done, for example, on files that have been modified or created by the adversary so that they do not appear conspicuous to forensic investigators or file analysis tools.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata, File: File Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Teams.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Malware Configuration

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

AV Detection

Privilege Escalation

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\MSTeamsSetup_c_l_.exe

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Squirrel.exe.log

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Update.exe.log

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\AddinInstaller.dll

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Large_120.png

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Large_144.png

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Large_192.png

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Large_96.png

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Small_120.png

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Small_144.png

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Small_192.png

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Assets\NewMeeting_Small_96.png

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.Applications.Telemetry.Windows.dll

C:\Users\user\AppData\Local\Microsoft\TeamsMeetingAddin\1.0.24151.1\x64\Microsoft.IdentityModel.JsonWebTokens.dll

Windows Analysis Report
Teams.exe

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre