14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37

Analysis

max time kernel
134s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20220414-en
submitted
02-06-2022 19:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exe
Size

4.8MB
MD5

4381866a52c954b95d195d4840db8aba
SHA1

9a2522fd00883dd3d63d2ec0538eae55fe49ff9b
SHA256

14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37
SHA512

e50d7a5251922b71e3ed902f79d1572686cc019a7946fd2301df3cb4df4daf3dcab5857412ae3d4628480e33e04584702d1e056492682382312d011cce1a9bc0

Score

8^/10

persistence spyware stealer

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

Processes:

DrvInst.exe

description	ioc	process
File opened for modification	C:\Windows\System32\drivers\SET38D3.tmp	DrvInst.exe
File created	C:\Windows\System32\drivers\SET38D3.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\drivers\teamviewervpn.sys	DrvInst.exe

Executes dropped EXE 5 IoCs

Processes:

257.exe257.tmpupdate_w32.exesvpn.exesvpn.exe

pid process

4360 257.exe
1976 257.tmp
4468 update_w32.exe
4296 svpn.exe
1496 svpn.exe

pid	process
4360	257.exe
1976	257.tmp
4468	update_w32.exe
4296	svpn.exe
1496	svpn.exe

Sets DLL path for service in the registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

update_w32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\usbhubsvc3\Parameters\ServiceDLL = "C:\\Users\\Admin\\AppData\\Roaming\\MicrocoftUrdateNT\\MSIMG32.dll"	update_w32.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

257.tmpupdate_w32.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	257.tmp
Key value queried	\REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation	update_w32.exe

Drops startup file 1 IoCs

Processes:

update_w32.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows Update Manager.lnk	update_w32.exe

Loads dropped DLL 9 IoCs

Processes:

257.tmpupdate_w32.exe

pid	process
1976	257.tmp
4468	update_w32.exe
4468	update_w32.exe
4468	update_w32.exe
4468	update_w32.exe
4468	update_w32.exe
4468	update_w32.exe
4468	update_w32.exe
4468	update_w32.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

Processes:

14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exeupdate_w32.exe

description	ioc	process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\""	14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exe
Key created	\REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\Run	update_w32.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\update_w32.exe = "\"C:\\Windows\\SysWOW64\\regsvr32.exe\" /s \"C:\\Users\\Admin\\AppData\\Roaming\\MicrocoftUrdateNT\\MSIMG32.dll\" C:\\Users\\Admin\\AppData\\Roaming\\MicrocoftUrdateNT\\update_w32.exe"	update_w32.exe
Key created	\REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce	14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exe

Drops file in System32 directory 16 IoCs

Processes:

DrvInst.exesvpn.exe

description	ioc	process
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\teamviewervpn.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\SET224F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\teamviewervpn.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.inf	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\SET223D.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\teamviewervpn.cat	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\SET224E.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\drvstore.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.sys	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\SET224F.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}	DrvInst.exe
File created	C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.PNF	svpn.exe
File opened for modification	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\SET223D.tmp	DrvInst.exe
File created	C:\Windows\System32\DriverStore\Temp\{2e9fe92a-3af7-494c-8711-88c3fe1b7eec}\SET224E.tmp	DrvInst.exe
File opened for modification	C:\Windows\System32\CatRoot2\dberr.txt	DrvInst.exe

Drops file in Windows directory 6 IoCs

Processes:

DrvInst.exeDrvInst.exesvpn.exesvchost.exe

description	ioc	process
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\inf\oem2.inf	DrvInst.exe
File created	C:\Windows\inf\oem2.inf	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	DrvInst.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svpn.exe
File opened for modification	C:\Windows\INF\setupapi.dev.log	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Checks SCSI registry key(s) 3 TTPs 38 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

DrvInst.exeDrvInst.exesvpn.exesvpn.exesvchost.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Service	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\LowerFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	svpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\CompatibleIDs	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Phantom	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\UpperFilters	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\CompatibleIDs	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\ConfigFlags	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Phantom	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Filters	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Service	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	DrvInst.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\HardwareID	svpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svpn.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\ConfigFlags	svpn.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_DADY_DVD-ROM\4&215468A5&0&010000	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_DADY_DVD-ROM\4&215468a5&0&010000\Properties\{83da6326-97a6-4088-9453-a1923f573b29}\0009	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_DADY&PROD_HARDDISK\4&215468A5&0&000000	svchost.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\HardwareID	DrvInst.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Filters	DrvInst.exe

Kills process with taskkill 4 IoCs
evasion

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exe

pid process

3056 taskkill.exe
4444 taskkill.exe
4580 taskkill.exe
4080 taskkill.exe

pid	process
3056	taskkill.exe
4444	taskkill.exe
4580	taskkill.exe
4080	taskkill.exe

Modifies data under HKEY_USERS 41 IoCs

Processes:

DrvInst.exe

description	ioc	process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	DrvInst.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	DrvInst.exe

Runs ping.exe 1 TTPs 1 IoCs

Remote System Discovery
T1018

Processes:

PING.EXE

pid process

2360 PING.EXE
Suspicious behavior: EnumeratesProcesses 6 IoCs

Processes:

257.tmpupdate_w32.exe

pid process

1976 257.tmp
1976 257.tmp
4468 update_w32.exe
4468 update_w32.exe
4468 update_w32.exe
4468 update_w32.exe

pid	process
2360	PING.EXE

Suspicious use of AdjustPrivilegeToken 15 IoCs

Processes:

taskkill.exetaskkill.exetaskkill.exetaskkill.exesvchost.exesvpn.exeDrvInst.exesvpn.exeupdate_w32.exe

description	pid	process
Token: SeDebugPrivilege	3056	taskkill.exe
Token: SeDebugPrivilege	4444	taskkill.exe
Token: SeDebugPrivilege	4580	taskkill.exe
Token: SeDebugPrivilege	4080	taskkill.exe
Token: SeAuditPrivilege	640	svchost.exe
Token: SeSecurityPrivilege	640	svchost.exe
Token: SeLoadDriverPrivilege	4296	svpn.exe
Token: SeRestorePrivilege	3968	DrvInst.exe
Token: SeBackupPrivilege	3968	DrvInst.exe
Token: SeLoadDriverPrivilege	3968	DrvInst.exe
Token: SeLoadDriverPrivilege	3968	DrvInst.exe
Token: SeLoadDriverPrivilege	3968	DrvInst.exe
Token: SeLoadDriverPrivilege	1496	svpn.exe
Token: SeLoadDriverPrivilege	1496	svpn.exe
Token: SeDebugPrivilege	4468	update_w32.exe

Suspicious use of FindShellTrayWindow 1 IoCs

Processes:

257.tmp

pid process

1976 257.tmp

Suspicious use of WriteProcessMemory 38 IoCs

Processes:

14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.execmd.exe257.exe257.tmpupdate_w32.exesvchost.exe

description	pid	process	target process
PID 1820 wrote to memory of 1828	1820	14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exe	cmd.exe
PID 1820 wrote to memory of 1828	1820	14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exe	cmd.exe
PID 1820 wrote to memory of 1828	1820	14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exe	cmd.exe
PID 1828 wrote to memory of 2360	1828	cmd.exe	PING.EXE
PID 1828 wrote to memory of 2360	1828	cmd.exe	PING.EXE
PID 1828 wrote to memory of 2360	1828	cmd.exe	PING.EXE
PID 1828 wrote to memory of 2492	1828	cmd.exe	find.exe
PID 1828 wrote to memory of 2492	1828	cmd.exe	find.exe
PID 1828 wrote to memory of 2492	1828	cmd.exe	find.exe
PID 1828 wrote to memory of 3056	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 3056	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 3056	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4444	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4444	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4444	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4580	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4580	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4580	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4080	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4080	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4080	1828	cmd.exe	taskkill.exe
PID 1828 wrote to memory of 4360	1828	cmd.exe	257.exe
PID 1828 wrote to memory of 4360	1828	cmd.exe	257.exe
PID 1828 wrote to memory of 4360	1828	cmd.exe	257.exe
PID 4360 wrote to memory of 1976	4360	257.exe	257.tmp
PID 4360 wrote to memory of 1976	4360	257.exe	257.tmp
PID 4360 wrote to memory of 1976	4360	257.exe	257.tmp
PID 1976 wrote to memory of 4468	1976	257.tmp	update_w32.exe
PID 1976 wrote to memory of 4468	1976	257.tmp	update_w32.exe
PID 1976 wrote to memory of 4468	1976	257.tmp	update_w32.exe
PID 4468 wrote to memory of 4296	4468	update_w32.exe	svpn.exe
PID 4468 wrote to memory of 4296	4468	update_w32.exe	svpn.exe
PID 640 wrote to memory of 4620	640	svchost.exe	DrvInst.exe
PID 640 wrote to memory of 4620	640	svchost.exe	DrvInst.exe
PID 640 wrote to memory of 3968	640	svchost.exe	DrvInst.exe
PID 640 wrote to memory of 3968	640	svchost.exe	DrvInst.exe
PID 4468 wrote to memory of 1496	4468	update_w32.exe	svpn.exe
PID 4468 wrote to memory of 1496	4468	update_w32.exe	svpn.exe

C:\Users\Admin\AppData\Local\Temp\14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exe
"C:\Users\Admin\AppData\Local\Temp\14957f48f88223038ffe8a431776f42cf5cc80cd606f329055b54974a27b5d37.exe"
1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1820

C:\Windows\SysWOW64\cmd.exe
cmd.exe /c 257.bat
2⤵
- Suspicious use of WriteProcessMemory
PID:1828

C:\Windows\SysWOW64\PING.EXE
ping -n 2 google.com
3⤵
- Runs ping.exe
PID:2360

C:\Windows\SysWOW64\find.exe
Find /I "TTL="
3⤵
PID:2492

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im svnhost.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3056

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im update_w32.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4444

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tv_w32.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4580

C:\Windows\SysWOW64\taskkill.exe
taskkill /f /im tv_x64.exe
3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4080

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\257.exe
257.exe /verysilent /Password=5555666876676
3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4360

C:\Users\Admin\AppData\Local\Temp\is-674VH.tmp\257.tmp
"C:\Users\Admin\AppData\Local\Temp\is-674VH.tmp\257.tmp" /SL5="$50170,4502149,277504,C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\257.exe" /verysilent /Password=5555666876676
4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1976

C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\update_w32.exe
"C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\update_w32.exe"
5⤵
- Executes dropped EXE
- Sets DLL path for service in the registry
- Checks computer location settings
- Drops startup file
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4468

C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\svpn.exe
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\svpn.exe install C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewerVPN.inf teamviewervpn
6⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:4296

C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\svpn.exe
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\svpn.exe restart teamviewervpn
6⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:1496

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k MsHubSvc -svcr C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\update_w32.exe
1⤵
PID:4264

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
1⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:640

C:\Windows\system32\DrvInst.exe
DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{31ac749f-a29e-f04c-a93b-916dbde3a34c}\teamviewervpn.inf" "9" "4b0706d3f" "0000000000000148" "WinSta0\Default" "0000000000000150" "208" "c:\users\admin\appdata\roaming\microcofturdatent"
2⤵
- Drops file in System32 directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4620

C:\Windows\system32\DrvInst.exe
DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem2.inf" "oem2.inf:3beb73aff103cc24:teamviewervpn.ndi:2.10.0.0:teamviewervpn," "4b0706d3f" "0000000000000148"
2⤵
- Drops file in Drivers directory
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
PID:3968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials in Files

T1081

Discovery

Query Registry

T1012

System Information Discovery

T1082

Peripheral Device Discovery

T1120

Remote System Discovery

T1018

Lateral Movement

Collection

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\257.bat
Filesize
6KB

MD5
50a7c9221869857d8384657bacbec607

SHA1
1b3c50aaafdc9a187cbebc832b718e7a93dc3764

SHA256
9ff9f5e355ef7e62badd899558d1b70f22ab6dcedbf6b214726456f14a424260

SHA512
55a7882f32ae2d2907a7dcd3ccce01a0446b1c333c784a59f26eee0838a576d15b429c361d9ee3c7e9a5b89565338556f3494aea40dcbfd0afedf5f93becfc6b

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\257.exe
Filesize
4.8MB

MD5
2dc181e2b9040aedc7731007065bade1

SHA1
c2fa159e0c9996e69cd11d848b6b794ab8909ffe

SHA256
9fa3524b737ef4d93bbd638837e79a8b19d5cda2cdd5cc5245bdb9578d095cc2

SHA512
3bffcd7b124d64468d3cb1cc2b1c8e9c39942b226db67770c91b67bb0d41a2517b4c27cf469291d6b0c1e0a39a820f21093c1e937213d04defcbf7fbfc748021

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\257.exe
Filesize
4.8MB

MD5
2dc181e2b9040aedc7731007065bade1

SHA1
c2fa159e0c9996e69cd11d848b6b794ab8909ffe

SHA256
9fa3524b737ef4d93bbd638837e79a8b19d5cda2cdd5cc5245bdb9578d095cc2

SHA512
3bffcd7b124d64468d3cb1cc2b1c8e9c39942b226db67770c91b67bb0d41a2517b4c27cf469291d6b0c1e0a39a820f21093c1e937213d04defcbf7fbfc748021

Download Submit
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\3.txt
Filesize
9B

MD5
fbb297e70ec689cb12d60236eaf12250

SHA1
e3f15a9ca373034aa739cbd495a7878227d38c95

SHA256
680470968ad66fd1e9427edba38a8053a231942d7097922037a9b8b508a35e1b

SHA512
5587dc0509f3fc8fc014cf3bd5195fb6abeda2ea21ad981cd545954d1ebb8677578e4fa02d8037194432833eb93cfb2d9002c94ebf68b97b408d1b38daacda04

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-674VH.tmp\257.tmp
Filesize
1.3MB

MD5
aca2a707c445ecceb034dbcf91c644fe

SHA1
60b17fd46237150f7b87a67a6d886cbef9f88908

SHA256
782de7f1b5662b5fdd2759bb23df8a08c362f31e3fb2e778686d63bcd63f5f3f

SHA512
dbf72cfd1c600fbbb22a5e4de0c178e9aa880a0917fe7290dbeda403da1bbc74bb09691da9787a3f7c2b7bc4c6037526f1a0fe4a85b6dc2985345e08ec2d773f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-674VH.tmp\257.tmp
Filesize
1.3MB

MD5
aca2a707c445ecceb034dbcf91c644fe

SHA1
60b17fd46237150f7b87a67a6d886cbef9f88908

SHA256
782de7f1b5662b5fdd2759bb23df8a08c362f31e3fb2e778686d63bcd63f5f3f

SHA512
dbf72cfd1c600fbbb22a5e4de0c178e9aa880a0917fe7290dbeda403da1bbc74bb09691da9787a3f7c2b7bc4c6037526f1a0fe4a85b6dc2985345e08ec2d773f

Download Submit
C:\Users\Admin\AppData\Local\Temp\is-GCLEA.tmp\_isetup\_iscrypt.dll
Filesize
2KB

MD5
a69559718ab506675e907fe49deb71e9

SHA1
bc8f404ffdb1960b50c12ff9413c893b56f2e36f

SHA256
2f6294f9aa09f59a574b5dcd33be54e16b39377984f3d5658cda44950fa0f8fc

SHA512
e52e0aa7fe3f79e36330c455d944653d449ba05b2f9abee0914a0910c3452cfa679a40441f9ac696b3ccf9445cbb85095747e86153402fc362bb30ac08249a63

Download Submit
C:\Users\Admin\AppData\Local\Temp\{31AC7~1\teamviewervpn.cat
Filesize
10KB

MD5
5cffe65f36b60bc151486c90382f1627

SHA1
f2a66eae89b4b19d4cab2ac630536af5eeeef121

SHA256
aa7c09a817eb54e3cc5c342454608364a679e231824f83ba5a2d0278edcc1851

SHA512
1bd48ef66f8714e7e9591043d03bd69a30881ed3d0f2463b15750a3282df667ffb076b3a92358eecedae0e54485b07d702667e8fe0af64c52be04db47145920b

Download Submit
C:\Users\Admin\AppData\Local\Temp\{31AC7~1\teamviewervpn.sys
Filesize
34KB

MD5
f5520dbb47c60ee83024b38720abda24

SHA1
bc355c14a2b22712b91ff43cd4e046489a91cae5

SHA256
b8e555d92440bf93e3b55a66e27cef936477ef7528f870d3b78bd3b294a05cc0

SHA512
3c5bb212467d932f5eaa17a2346ef8f401a49760c9c6c89c6318a1313fcbabb1d43b1054692c01738ea6a3648cc57e06845b81becb3069f478d5b1a7cbcb0e66

Download Submit
C:\Users\Admin\AppData\Local\Temp\{31ac749f-a29e-f04c-a93b-916dbde3a34c}\teamviewervpn.inf
Filesize
5KB

MD5
447fc733747db11cd4492ae01c5652fe

SHA1
2a70dcd391464cb8d3736322e07e966e105d396e

SHA256
a817b0e8a669d5acaf2ddfbc95acf2a1213b092b44dc896a0ee4a5301d06ebc3

SHA512
238099db072af55445d421e941944abe8a6f52a124a26cae84c1dd52fffafc4dac5586d0c7407b461cd0db8e771e1dbb6ca34aee84581b24347f401410b2afe5

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\MSIMG32.dll
Filesize
98KB

MD5
1501983b23d8a72ba675a9888a3757cf

SHA1
7fe97f13e0353d16a589e6acda222ffee689453f

SHA256
604acb69bbd4b0a1ae1bda8d53a52be4fa0b6897e636203e6a0cd70fba2678c5

SHA512
795816d5e1d2a113890e42970f92cb21dfe818109f451487f0b693cb370e01dbed33639fd3b26b8a1969b28cb0434b4a18b3ff65b355ab66dc1acf056e5a2631

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewerVPN.inf
Filesize
5KB

MD5
447fc733747db11cd4492ae01c5652fe

SHA1
2a70dcd391464cb8d3736322e07e966e105d396e

SHA256
a817b0e8a669d5acaf2ddfbc95acf2a1213b092b44dc896a0ee4a5301d06ebc3

SHA512
238099db072af55445d421e941944abe8a6f52a124a26cae84c1dd52fffafc4dac5586d0c7407b461cd0db8e771e1dbb6ca34aee84581b24347f401410b2afe5

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_Desktop.exe
Filesize
2.2MB

MD5
36738935b6eadbdf570002ee44990360

SHA1
2621f86a0307a6be7032266db868c7af981bc016

SHA256
46aa5507bf0866d924a7974e7dc9255db21efb8ba5dc15e3c1a19c5b408ad29c

SHA512
5737edd344008832b1925972913cb2ba49d1e177a331a5419c5f6cb966f7da735fff1722acf59d5514cf63c2834a5f49d9784b70996fb0186cbbab6de3835f14

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_Resource_en.dll
Filesize
285KB

MD5
5850b0e30cb6493170ea8d073f34766c

SHA1
d80b0181edca5be738f8c1c4355c4785d0360d06

SHA256
97f8b0f6307156c0c74f3309195c376e5d816b3dbd65048c241a8b7e9233eeda

SHA512
a1a8ee334ef763a78214fbc6a915e9adbf0cdbafb6694fac6e70cb68f2aacfcad945c7b4629bf3b729e8b9b3fcd7956c04a63c89fb6bda7111f41f9c8cb96144

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_Resource_en.dll
Filesize
285KB

MD5
5850b0e30cb6493170ea8d073f34766c

SHA1
d80b0181edca5be738f8c1c4355c4785d0360d06

SHA256
97f8b0f6307156c0c74f3309195c376e5d816b3dbd65048c241a8b7e9233eeda

SHA512
a1a8ee334ef763a78214fbc6a915e9adbf0cdbafb6694fac6e70cb68f2aacfcad945c7b4629bf3b729e8b9b3fcd7956c04a63c89fb6bda7111f41f9c8cb96144

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_Resource_en.dll
Filesize
285KB

MD5
5850b0e30cb6493170ea8d073f34766c

SHA1
d80b0181edca5be738f8c1c4355c4785d0360d06

SHA256
97f8b0f6307156c0c74f3309195c376e5d816b3dbd65048c241a8b7e9233eeda

SHA512
a1a8ee334ef763a78214fbc6a915e9adbf0cdbafb6694fac6e70cb68f2aacfcad945c7b4629bf3b729e8b9b3fcd7956c04a63c89fb6bda7111f41f9c8cb96144

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_Resource_en.dll
Filesize
285KB

MD5
5850b0e30cb6493170ea8d073f34766c

SHA1
d80b0181edca5be738f8c1c4355c4785d0360d06

SHA256
97f8b0f6307156c0c74f3309195c376e5d816b3dbd65048c241a8b7e9233eeda

SHA512
a1a8ee334ef763a78214fbc6a915e9adbf0cdbafb6694fac6e70cb68f2aacfcad945c7b4629bf3b729e8b9b3fcd7956c04a63c89fb6bda7111f41f9c8cb96144

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_Resource_en.dll
Filesize
285KB

MD5
5850b0e30cb6493170ea8d073f34766c

SHA1
d80b0181edca5be738f8c1c4355c4785d0360d06

SHA256
97f8b0f6307156c0c74f3309195c376e5d816b3dbd65048c241a8b7e9233eeda

SHA512
a1a8ee334ef763a78214fbc6a915e9adbf0cdbafb6694fac6e70cb68f2aacfcad945c7b4629bf3b729e8b9b3fcd7956c04a63c89fb6bda7111f41f9c8cb96144

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_StaticRes.dll
Filesize
2.5MB

MD5
4202e46ac536822fd7043c38e66d0ec8

SHA1
c8908477b539931168e9437d4e17e7c33fb10141

SHA256
542075ba11aaa6c1961985818dc4bb9e1a13afffeaef3514389444db18938fb4

SHA512
20210b8dd54b7ca527e69699ae02d6b1c1733e8e3c8ae797994d24b2134e91d4dbc8345b9a4757ded6a34f460d9ec88b1c133202718e342c9045c77de2bd784d

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_StaticRes.dll
Filesize
2.5MB

MD5
4202e46ac536822fd7043c38e66d0ec8

SHA1
c8908477b539931168e9437d4e17e7c33fb10141

SHA256
542075ba11aaa6c1961985818dc4bb9e1a13afffeaef3514389444db18938fb4

SHA512
20210b8dd54b7ca527e69699ae02d6b1c1733e8e3c8ae797994d24b2134e91d4dbc8345b9a4757ded6a34f460d9ec88b1c133202718e342c9045c77de2bd784d

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\TeamViewer_StaticRes.dll
Filesize
2.5MB

MD5
4202e46ac536822fd7043c38e66d0ec8

SHA1
c8908477b539931168e9437d4e17e7c33fb10141

SHA256
542075ba11aaa6c1961985818dc4bb9e1a13afffeaef3514389444db18938fb4

SHA512
20210b8dd54b7ca527e69699ae02d6b1c1733e8e3c8ae797994d24b2134e91d4dbc8345b9a4757ded6a34f460d9ec88b1c133202718e342c9045c77de2bd784d

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\addons.bac
Filesize
968KB

MD5
9d0b53db693900ef3ed8b414e0bc2e72

SHA1
52c1c94943bef35272328651d3beec6b1b191fbf

SHA256
3034ea53492e768b2cf3bcffef244e6cef4d687f7131017acaa4ef5d1f939acc

SHA512
b1e9914c10c68a203ce3b287bec32071e282b0b68e0a2abd1424659ba1af5ab102f79201d9e5e405c0c38044fbf82202260a932a3fa2642dd6bdeda739e9b8ec

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\msimg32.dll
Filesize
98KB

MD5
1501983b23d8a72ba675a9888a3757cf

SHA1
7fe97f13e0353d16a589e6acda222ffee689453f

SHA256
604acb69bbd4b0a1ae1bda8d53a52be4fa0b6897e636203e6a0cd70fba2678c5

SHA512
795816d5e1d2a113890e42970f92cb21dfe818109f451487f0b693cb370e01dbed33639fd3b26b8a1969b28cb0434b4a18b3ff65b355ab66dc1acf056e5a2631

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\svpn.exe
Filesize
79KB

MD5
112b0c8b6b0c0a6c24f90081cc8a77d0

SHA1
1776a73316baeeb818884196a54f49d1385c06c8

SHA256
f627380e9de14af3eb5331bb9a4d559b2c970abacff038ea464044ca1ef62163

SHA512
1552b267931004d8936058f5cac49dc618eae2224ea3b082f1d899cd1b2c1cb7eaa98ac7653740fd07b2df40abbdd2d6318a9bed8794bb7a8872e379a50ef585

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\svpn.exe
Filesize
79KB

MD5
112b0c8b6b0c0a6c24f90081cc8a77d0

SHA1
1776a73316baeeb818884196a54f49d1385c06c8

SHA256
f627380e9de14af3eb5331bb9a4d559b2c970abacff038ea464044ca1ef62163

SHA512
1552b267931004d8936058f5cac49dc618eae2224ea3b082f1d899cd1b2c1cb7eaa98ac7653740fd07b2df40abbdd2d6318a9bed8794bb7a8872e379a50ef585

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\svpn.exe
Filesize
79KB

MD5
112b0c8b6b0c0a6c24f90081cc8a77d0

SHA1
1776a73316baeeb818884196a54f49d1385c06c8

SHA256
f627380e9de14af3eb5331bb9a4d559b2c970abacff038ea464044ca1ef62163

SHA512
1552b267931004d8936058f5cac49dc618eae2224ea3b082f1d899cd1b2c1cb7eaa98ac7653740fd07b2df40abbdd2d6318a9bed8794bb7a8872e379a50ef585

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\tv_w32.dll
Filesize
66KB

MD5
55b4875e6dd84b1a547a91a789515dfb

SHA1
ad598670ced636134f85c744f6283a16e3766d1f

SHA256
a0791b2f732fdd0c26483d9ef2d77e720d9ba267f887eccadff227bcf247a0a9

SHA512
d9dc737c25a56503bba8f3a2fa030c3dc1fe62f4313cb307203cdcac164fd6bb2fa2ab87be6806d4cf3d1ed1ec880a1c7f3d866e61c3a6005ca400ff9f99459a

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\tv_w32.dll
Filesize
66KB

MD5
55b4875e6dd84b1a547a91a789515dfb

SHA1
ad598670ced636134f85c744f6283a16e3766d1f

SHA256
a0791b2f732fdd0c26483d9ef2d77e720d9ba267f887eccadff227bcf247a0a9

SHA512
d9dc737c25a56503bba8f3a2fa030c3dc1fe62f4313cb307203cdcac164fd6bb2fa2ab87be6806d4cf3d1ed1ec880a1c7f3d866e61c3a6005ca400ff9f99459a

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\tv_w32.exe
Filesize
104KB

MD5
c16719e5c670b7c18aab69dea8ea8c66

SHA1
95c9c3b44dcca278b42cb20b1e27d88ae4006f39

SHA256
c23d33f637c3c90ce0e3fc366fce034c5592dd80b660f469619e38b255532689

SHA512
9bae42f6e6ace1e1f0d923894399817a017a1e52e2b01bb780d2a7be20f82ac341b1c9f6de680f16a0b8d5532c0f77f495dde2ad0c95ff85118021785dcd3b3b

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\tv_x64.dll
Filesize
80KB

MD5
6f68147027ba59a8af86ffe1b8fc6899

SHA1
99bb32e1d752a2b93bcd9db36b8a4f3c01ba6458

SHA256
07413a73f7566173b462d7a4de2ca74d211f0872682160afafa618e656cfe9e6

SHA512
5011e05ebcf6e86a988ba79e3f0aec2f240b14c5a602260edc53fa1c4b11c23495171213fe30ab8bf53f9e0c15e6dffa6a463105d1d558a3def50fdc28e571d2

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\tv_x64.exe
Filesize
126KB

MD5
8e50a67752bd070fec717216b9376a7f

SHA1
19c776fd0fe89d6cb3f372d89cac4adf65dabe24

SHA256
f7b239c4101db7c974eef31ba2dd42fba0e898cfa762b1e969f76a7a37aa3d8b

SHA512
be16f2fc675d1231275fd618ea101bfafa71c31b2cea92c5fb1197384bd0ea764e4567350bc1309d9d83439a977ed7600c57c4f5be81bf7170b2d5e59fe1ef46

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\tvr.cfg
Filesize
354B

MD5
e6526bf9ee3b1b06686ed3b6e92740bb

SHA1
340cd16654fbd3e3ea29c1090677d98826234a12

SHA256
065f09813d458daac75661e40fece2055e06a7562996a5a845e725463af5f037

SHA512
e4d0ea5c5a0d420d06872b49aaf55eab7c6a976860c6e7c1525c849b31cb7a7cc0e7ef7cb670053b57244fff01bd04e7a2a80ddb70a378e3fea330c4314d282d

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\update_w32.exe
Filesize
7.7MB

MD5
f5fe906f801d99fafa8a9e0584a37008

SHA1
a80175b91e3f9606e63dd0d9a9271e23bbe10321

SHA256
10b12825603dc3f1946bfd4e7cbebda5885fe4fccaeb0df8b6e862ad3dad720b

SHA512
ae149680b212cf0b7f11d841cede275d8e510d3af86c96d75ff75802a8543773a5b7fc9d4c84d4d5fa486d2ddf27129cc42e70d0ea34ca2624f14152ba7497de

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\update_w32.exe
Filesize
7.7MB

MD5
f5fe906f801d99fafa8a9e0584a37008

SHA1
a80175b91e3f9606e63dd0d9a9271e23bbe10321

SHA256
10b12825603dc3f1946bfd4e7cbebda5885fe4fccaeb0df8b6e862ad3dad720b

SHA512
ae149680b212cf0b7f11d841cede275d8e510d3af86c96d75ff75802a8543773a5b7fc9d4c84d4d5fa486d2ddf27129cc42e70d0ea34ca2624f14152ba7497de

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\vpn64.cab
Filesize
54KB

MD5
d4fe3ae6d05b2d4cb52484e2718ab390

SHA1
8da95d697c578c8d12e02c53fb185cb5825c4f63

SHA256
0fc7396c9eb14f764b18400f95c66fd168ec0626d455b48167119227b3b98c1e

SHA512
03a253bbc1663b7c03632c4a265195e2d668da5a0b3c6144ed2006fdffe50e131bb2a589aa41304e20979fa9a27e2acdbe8860916219d8ee265ebc185ef60fdd

Download Submit
C:\Users\Admin\AppData\Roaming\MicrocoftUrdateNT\vpn86.cab
Filesize
42KB

MD5
c7549d78f082a6cf81ba2c27f6c6a38f

SHA1
ea39fbc80cc62c11ace1ef495c856f3bc6c775a7

SHA256
240b9ee414817f500c18bffaba787c6f7b5e67a0e46d82cbbce02cb956073be3

SHA512
ffa75d64446b227642af964c6d5a8e1a14493b56d598b52cbd842cf22a9396eddde716effc431d25b21a26741bdaf9e2b509821099a5eb3e01bfc2343816fc2f

Download Submit
C:\Windows\INF\oem2.inf
Filesize
5KB

MD5
447fc733747db11cd4492ae01c5652fe

SHA1
2a70dcd391464cb8d3736322e07e966e105d396e

SHA256
a817b0e8a669d5acaf2ddfbc95acf2a1213b092b44dc896a0ee4a5301d06ebc3

SHA512
238099db072af55445d421e941944abe8a6f52a124a26cae84c1dd52fffafc4dac5586d0c7407b461cd0db8e771e1dbb6ca34aee84581b24347f401410b2afe5

Download Submit
C:\Windows\System32\DriverStore\FileRepository\TEAMVI~1.INF\teamviewervpn.sys
Filesize
34KB

MD5
f5520dbb47c60ee83024b38720abda24

SHA1
bc355c14a2b22712b91ff43cd4e046489a91cae5

SHA256
b8e555d92440bf93e3b55a66e27cef936477ef7528f870d3b78bd3b294a05cc0

SHA512
3c5bb212467d932f5eaa17a2346ef8f401a49760c9c6c89c6318a1313fcbabb1d43b1054692c01738ea6a3648cc57e06845b81becb3069f478d5b1a7cbcb0e66

Download Submit
C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.inf
Filesize
5KB

MD5
447fc733747db11cd4492ae01c5652fe

SHA1
2a70dcd391464cb8d3736322e07e966e105d396e

SHA256
a817b0e8a669d5acaf2ddfbc95acf2a1213b092b44dc896a0ee4a5301d06ebc3

SHA512
238099db072af55445d421e941944abe8a6f52a124a26cae84c1dd52fffafc4dac5586d0c7407b461cd0db8e771e1dbb6ca34aee84581b24347f401410b2afe5

Download Submit
\??\c:\users\admin\appdata\roaming\MICROC~1\TEAMVI~1.SYS
Filesize
34KB

MD5
f5520dbb47c60ee83024b38720abda24

SHA1
bc355c14a2b22712b91ff43cd4e046489a91cae5

SHA256
b8e555d92440bf93e3b55a66e27cef936477ef7528f870d3b78bd3b294a05cc0

SHA512
3c5bb212467d932f5eaa17a2346ef8f401a49760c9c6c89c6318a1313fcbabb1d43b1054692c01738ea6a3648cc57e06845b81becb3069f478d5b1a7cbcb0e66

Download Submit
\??\c:\users\admin\appdata\roaming\microcofturdatent\teamviewervpn.cat
Filesize
10KB

MD5
5cffe65f36b60bc151486c90382f1627

SHA1
f2a66eae89b4b19d4cab2ac630536af5eeeef121

SHA256
aa7c09a817eb54e3cc5c342454608364a679e231824f83ba5a2d0278edcc1851

SHA512
1bd48ef66f8714e7e9591043d03bd69a30881ed3d0f2463b15750a3282df667ffb076b3a92358eecedae0e54485b07d702667e8fe0af64c52be04db47145920b

Download Submit
memory/1496-186-0x0000000000000000-mapping.dmp

Download
memory/1828-130-0x0000000000000000-mapping.dmp

Download
memory/1976-143-0x0000000000000000-mapping.dmp

Download
memory/2360-132-0x0000000000000000-mapping.dmp

Download
memory/2492-133-0x0000000000000000-mapping.dmp

Download
memory/3056-134-0x0000000000000000-mapping.dmp

Download
memory/3968-183-0x0000000000000000-mapping.dmp

Download
memory/4080-137-0x0000000000000000-mapping.dmp

Download
memory/4296-169-0x0000000000000000-mapping.dmp

Download
memory/4360-138-0x0000000000000000-mapping.dmp

Download
memory/4360-146-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4360-173-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4360-141-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4360-174-0x0000000000400000-0x000000000044E000-memory.dmp

Filesize
312KB

Download
memory/4444-135-0x0000000000000000-mapping.dmp

Download
memory/4468-153-0x0000000010000000-0x0000000010017000-memory.dmp

Filesize
92KB

Download
memory/4468-148-0x0000000000000000-mapping.dmp

Download
memory/4468-195-0x0000000004CA0000-0x0000000004CC7000-memory.dmp

Filesize
156KB

Download
memory/4468-196-0x0000000004CA1000-0x0000000004CBE000-memory.dmp

Filesize
116KB

Download
memory/4580-136-0x0000000000000000-mapping.dmp

Download
memory/4620-178-0x0000000000000000-mapping.dmp

Download