Overview

overview

9

Static

static

3

jaffacakes...eu.exe

windows10-2004-x64

9

jaffacakes...eu.exe

windows11-ltsc_2024-x64

9

Analysis

  • max time kernel
    147s
  • max time network
    150s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    18/10/2026, 23:08

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
  • Size 3.1MB
  • Sample261018-24tdssda39
  • SHA256 6e65e0116ca91fa444dbc833d801d1446b74f21513ae42286f51d8744eadca7a
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
defense_evasiondiscoveryexploitpersistenceprivilege_escalationspywarestealerupx

Malware Config

Signatures

  • Detected Nirsoft tools 1 IoCs

    Free utilities often used by attackers which can steal passwords, product keys, etc.

  • NirSoft NirCmd 1 IoCs

    NirCmd is a lightweight Windows command-line tool for automating system tasks

  • Drops file in Drivers directory 3 IoCs
  • Modifies RDP port number used by Windows 1 TTPs
  • Modifies Windows Firewall 2 TTPs 8 IoCs
    defense_evasion
  • Possible privilege escalation attempt 2 IoCs
    exploit
  • Server Software Component: Terminal Services DLL 1 TTPs 1 IoCs
    persistence
  • Allows Network login with blank passwords 1 TTPs 1 IoCs

    Allows local user accounts with blank passwords to access device from the network.

  • Executes dropped EXE 8 IoCs
  • Loads dropped DLL 19 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
    discovery
  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Modifies WinLogon 2 TTPs 1 IoCs
    persistence
  • Network Share Discovery 1 TTPs

    Attempt to gather information on host network.

    discovery
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Windows directory 5 IoCs
  • Enumerates video capture drivers 2 TTPs 2 IoCs

    Queries the legacy Video for Windows capture drivers. This is commonly abused by RATs to check for available webcams on the system before reporting to their C2.

    discoverydefense_evasion
  • Launches sc.exe 2 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 9 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 58 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 41 IoCs
  • Modifies registry class 6 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe
    "C:\Users\Admin\AppData\Local\Temp\jaffacakes118_Trojan-Spy.Win32.TheRat.eu.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:5968
    • C:\Users\Admin\AppData\Local\Temp\nst2505.tmp\k2fl675x5el
      "C:\Users\Admin\AppData\Local\Temp\nst2505.tmp\k2fl675x5el" x -pE19B1ABA748D76C5D6C7EB9A5F88E083235C6C7E4373F6CEF5C0B75BDC028164FBD63D028B8D901DB1AA19FA5B8B8D58 "C:\Users\Admin\AppData\Local\Temp\9hdn20x9i5bxhgfel.jpg" "-oC:\Users\Admin\AppData\Roaming"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      PID:1156
    • C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde
      "C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde" wait 10000
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      PID:1404
    • C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde
      "C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde" shexec "" "C:\Users\Admin\AppData\Roaming\ehome\ehmsas.lnk"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:120
      • C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
        "C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Adds Run key to start application
        • Enumerates video capture drivers
        • Reads the TCP/IP host and domain name from the registry
        • System Location Discovery: System Language Discovery
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2440
        • C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe
          C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe -r install C:\Users\Admin\AppData\Roaming\ehome\x64\TeamViewerVPN.inf teamviewervpn
          4⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2020
        • C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe
          C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe restart teamviewervpn
          4⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          PID:2832
        • C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
          C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
          4⤵
          • Server Software Component: Terminal Services DLL
          • Allows Network login with blank passwords
          • Executes dropped EXE
          • Loads dropped DLL
          • Modifies WinLogon
          • Drops file in System32 directory
          • Enumerates video capture drivers
          • Reads the TCP/IP host and domain name from the registry
          • System Location Discovery: System Language Discovery
          • Modifies registry class
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:1820
          • C:\Windows\System32\net.exe
            C:\Windows\System32\net.exe stop TermService /y
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1572
            • C:\Windows\system32\net1.exe
              C:\Windows\system32\net1 stop TermService /y
              6⤵
                PID:2008
            • C:\Windows\System32\netsh.exe
              C:\Windows\System32\netsh.exe advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
              5⤵
              • Modifies Windows Firewall
              • Event Triggered Execution: Netsh Helper DLL
              PID:5932
            • C:\Windows\System32\sc.exe
              C:\Windows\System32\sc.exe config TermService start= auto
              5⤵
              • Launches sc.exe
              PID:5136
            • C:\Windows\System32\sc.exe
              C:\Windows\System32\sc.exe config DcomLauch start= auto
              5⤵
              • Launches sc.exe
              PID:5180
            • C:\Windows\System32\net.exe
              C:\Windows\System32\net.exe start TermService /y
              5⤵
              • Suspicious use of WriteProcessMemory
              PID:4764
              • C:\Windows\system32\net1.exe
                C:\Windows\system32\net1 start TermService /y
                6⤵
                  PID:4612
              • C:\Windows\System32\takeown.exe
                C:\Windows\System32\takeown.exe /f C:\Windows\System32\utilman.exe
                5⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                • Suspicious use of AdjustPrivilegeToken
                PID:5888
              • C:\Windows\System32\icacls.exe
                C:\Windows\System32\icacls.exe C:\Windows\System32\utilman.exe /grant *S-1-5-32-544:F
                5⤵
                • Possible privilege escalation attempt
                • Modifies file permissions
                PID:2320
              • C:\Windows\System32\netsh.exe
                C:\Windows\System32\netsh.exe advfirewall firewall add rule name="Remote Desktop" dir=in protocol=tcp localport=3389 profile=any action=allow
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:3368
              • C:\Windows\System32\netsh.exe
                C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Session-In)" new enable=yes profile=any action=allow
                5⤵
                • Modifies Windows Firewall
                • Event Triggered Execution: Netsh Helper DLL
                PID:3756
              • C:\Windows\System32\netsh.exe
                C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Session-Out)" new enable=yes profile=any action=allow
                5⤵
                • Modifies Windows Firewall
                PID:5500
              • C:\Windows\System32\netsh.exe
                C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (SMB-In)" new enable=yes profile=any action=allow
                5⤵
                • Modifies Windows Firewall
                PID:1348
              • C:\Windows\System32\netsh.exe
                C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (SMB-Out)" new enable=yes profile=any action=allow
                5⤵
                • Modifies Windows Firewall
                PID:5460
              • C:\Windows\System32\netsh.exe
                C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Name-In)" new enable=yes profile=any action=allow
                5⤵
                • Modifies Windows Firewall
                PID:2432
              • C:\Windows\System32\netsh.exe
                C:\Windows\System32\netsh.exe advfirewall firewall set rule name="File and Printer Sharing (NB-Name-Out)" new enable=yes profile=any action=allow
                5⤵
                • Modifies Windows Firewall
                PID:4432
      • C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
        C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • System Location Discovery: System Language Discovery
        PID:2720
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{05a01fac-29bf-9140-aecf-c6ddb5f74806}\teamviewervpn.inf" "9" "4b0706d3f" "00000000000000E0" "WinSta0\Default" "0000000000000114" "208" "c:\users\admin\appdata\roaming\ehome\x64"
        1⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:5672
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd\teamviewervpn.inf" "oem1.inf:3beb73aff103cc24:teamviewervpn.ndi:2.10.0.0:teamviewervpn," "4b0706d3f" "00000000000000E0" "d72e"
        1⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:5668
      • C:\Windows\System32\svchost.exe
        C:\Windows\System32\svchost.exe -k NetworkService -s TermService
        1⤵
        • Loads dropped DLL
        • Suspicious use of AdjustPrivilegeToken
        PID:4956

      Network

            MITRE ATT&CK Enterprise v16

            Reconnaissance

            Resource Development

            Initial Access

            Execution

            Persistence

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Server Software Component

            1
            T1505

            Terminal Services DLL

            1
            T1505.005

            Privilege Escalation

            Boot or Logon Autostart Execution

            2
            T1547

            Registry Run Keys / Startup Folder

            1
            T1547.001

            Winlogon Helper DLL

            1
            T1547.004

            Create or Modify System Process

            1
            T1543

            Windows Service

            1
            T1543.003

            Event Triggered Execution

            1
            T1546

            Netsh Helper DLL

            1
            T1546.007

            Defense Evasion

            File and Directory Permissions Modification

            1
            T1222

            Impair Defenses

            1
            T1562

            Disable or Modify System Firewall

            1
            T1562.004

            Modify Registry

            2
            T1112

            Credential Access

            Credentials from Password Stores

            1
            T1555

            Credentials from Web Browsers

            1
            T1555.003

            Unsecured Credentials

            1
            T1552

            Credentials In Files

            1
            T1552.001

            Discovery

            Network Share Discovery

            1
            T1135

            Peripheral Device Discovery

            2
            T1120

            Query Registry

            1
            T1012

            System Information Discovery

            2
            T1082

            System Location Discovery

            1
            T1614

            System Language Discovery

            1
            T1614.001

            System Network Configuration Discovery

            1
            T1016

            Lateral Movement

            Remote Services

            2
            T1021

            Remote Desktop Protocol

            2
            T1021.001

            Collection

            Data from Local System

            1
            T1005

            Video Capture

            1
            T1125

            Command and Control

            Exfiltration

            Impact

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            9hdn20x9i5bxhgfel.jpg
            • Path C:\Users\Admin\AppData\Local\Temp\9hdn20x9i5bxhgfel.jpg
            • Size 2.7MB
            • SHA256 e789fe6e2b98e75de8464503ce4b53455e3cf43b824b8bab3e3ef6205fb5ee4e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            cl3lt455q0oxde
            • Path C:\Users\Admin\AppData\Local\Temp\cl3lt455q0oxde
            • Size 43KB
            • SHA256 31b3b228382dc359f22ae97b2602eee81dc743fb21196061eacc6619533881f5
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            Crypto.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst2505.tmp\Crypto.dll
            • Size 3KB
            • SHA256 b7b819dcf3aaed2774cecfa507f9baee47660b18758f7cb718bb5cb2d77947fa
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            System.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst2505.tmp\System.dll
            • Size 11KB
            • SHA256 904fd5481d72f4e03b01a455f848dedd095d0fb17e33608e0d849f5196fb6ff8
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            k2fl675x5el
            • Path C:\Users\Admin\AppData\Local\Temp\nst2505.tmp\k2fl675x5el
            • Size 637KB
            • SHA256 e0e2c7d0f740fe2a4e8658ce54dfb6eb3c47c37fe90a44a839e560c685f1f1fa
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            nsExec.dll
            • Path C:\Users\Admin\AppData\Local\Temp\nst2505.tmp\nsExec.dll
            • Size 6KB
            • SHA256 c2c88e4a32c734b0cb4ae507c1a9a1b417a2375079111fb1b35fab23aedd41d9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            uulqllf69et5
            • Path C:\Users\Admin\AppData\Local\Temp\uulqllf69et5
            • Size 178B
            • SHA256 4947127aad44a160c610bc8c6246973943eb838ffb609d1e79ff1ef7512adbad
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            545d80
            • Path C:\Users\Admin\AppData\Roaming\ehome\545d80
            • Size 45KB
            • SHA256 38a5ffb91c9ce283316d61ee8f4ed7042e2c9007a17c67d96f0b2998e835cc4f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TeamViewer_Desktop.exe
            • Path C:\Users\Admin\AppData\Roaming\ehome\TeamViewer_Desktop.exe
            • Size 2.1MB
            • SHA256 9fe4685f1d76b3c0ff80e2b9348d5f1b5a7856d472ae4be4b0fe9d9c08d32669
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TeamViewer_Resource_en.dll
            • Path C:\Users\Admin\AppData\Roaming\ehome\TeamViewer_Resource_en.dll
            • Size 1.2MB
            • SHA256 a40088e36440f9de74bbd2d6e5cf969ab42ff629cea6d685cc9d8300b91b5028
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ehmsas.exe
            • Path C:\Users\Admin\AppData\Roaming\ehome\ehmsas.exe
            • Size 7.0MB
            • SHA256 5c80b0ced982b868d7e2ba6269509f597a05704fa6d86a30e8d51bf5687c3361
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            ehmsas.lnk
            • Path C:\Users\Admin\AppData\Roaming\ehome\ehmsas.lnk
            • Size 894B
            • SHA256 6434c449e5220cc2c6d1b7d5eace8358c1f89e7644dd4ee439a77960d1908b7f
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            hn65mvz063tghuli1.jpg
            • Path C:\Users\Admin\AppData\Roaming\ehome\hn65mvz063tghuli1.jpg
            • Size 8KB
            • SHA256 fe8fd071b3c574f41c42568283d92f541b25cf7812f1c4408943df04c45a649f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            installvpn.pg
            • Path C:\Users\Admin\AppData\Roaming\ehome\installvpn.pg
            • Size 3KB
            • SHA256 36c60f63fb12f9df18afb3e255b44d96ead54c9d48dcb4638e12b1a54475d0c2
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            rdw.pg
            • Path C:\Users\Admin\AppData\Roaming\ehome\rdw.pg
            • Size 406KB
            • SHA256 d9a301684e39a64c68f8a17374bf67acdc98fd17e7be79b610eda0ac09446e2e
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            scankey.pg
            • Path C:\Users\Admin\AppData\Roaming\ehome\scankey.pg
            • Size 2KB
            • SHA256 7fd3d650ffea9a2c4bb43770985a39d393d100c01569fd06fa67ff45f6403566
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tv.cfg
            • Path C:\Users\Admin\AppData\Roaming\ehome\tv.cfg
            • Size 916B
            • SHA256 a8127b3ed0f6d475303a934b06db5e4f3bc281cf2d5bb1ef5fcdbd5601f2c342
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            tv_w32.dll
            • Path C:\Users\Admin\AppData\Roaming\ehome\tv_w32.dll
            • Size 49KB
            • SHA256 d2b39bcf9ca3888887fb84a0897fcb80dccacc5ccfb5a66357e3dbdcafee3904
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tv_w32.exe
            • Path C:\Users\Admin\AppData\Roaming\ehome\tv_w32.exe
            • Size 106KB
            • SHA256 c96ed3b60727973d746834eaec3df520447a039dc447f717f6cd32335e2dc1d0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tv_x64.dll
            • Path C:\Users\Admin\AppData\Roaming\ehome\tv_x64.dll
            • Size 52KB
            • SHA256 a21dafab3d25f88d7001de9437f0a01c72d66db0c1a190dd5acdb2cc38ea9513
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            tv_x64.exe
            • Path C:\Users\Admin\AppData\Roaming\ehome\tv_x64.exe
            • Size 141KB
            • SHA256 7a487c2cba93e7d6963930c5734f14d6cf17e85fc2316d6aeccd617100a1ff9f
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TeamViewerVPN.inf
            • Path C:\Users\Admin\AppData\Roaming\ehome\x64\TeamViewerVPN.inf
            • Size 5KB
            • SHA256 a817b0e8a669d5acaf2ddfbc95acf2a1213b092b44dc896a0ee4a5301d06ebc3
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            install64.exe
            • Path C:\Users\Admin\AppData\Roaming\ehome\x64\install64.exe
            • Size 79KB
            • SHA256 f627380e9de14af3eb5331bb9a4d559b2c970abacff038ea464044ca1ef62163
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            TeamViewerVPN.inf
            • Path C:\Users\Admin\AppData\Roaming\ehome\x86\TeamViewerVPN.inf
            • Size 5KB
            • SHA256 6f15408132b38c37e1d12998d0df67bbe9664c4e0e927d5f87896fc251653769
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            install.exe
            • Path C:\Users\Admin\AppData\Roaming\ehome\x86\install.exe
            • Size 54KB
            • SHA256 64f42467a18009ae3d7cd24ed140141afd31826761944bd4e1891ea9f02411c9
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            teamviewervpn.cat
            • Path C:\Users\Admin\AppData\Roaming\ehome\x86\teamviewervpn.cat
            • Size 10KB
            • SHA256 28a25533a42223867256e64c1a75a9fa4831cd09e12a1bff3c63930583333a9b
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            teamviewervpn.sys
            • Path C:\Users\Admin\AppData\Roaming\ehome\x86\teamviewervpn.sys
            • Size 24KB
            • SHA256 58aab0f6ff78fd0ecdd8d9da1b6852e9e57e3daa39489abddba106ece0b3bca7
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            teamviewervpn.inf_amd64_5e1dcb6f86e23dcd.ini
            • Path C:\Windows\System32\DriverStore\FileRepository\teamviewervpn.inf_amd64_5e1dcb6f86e23dcd.ini
            • Size 440B
            • SHA256 edb200aa840e214846f3118efc62774be752c3466cc8536cc73b1bdb84488bd9
            • MD5 SHA1 SHA512 TLSH
            Submit Download

            teamviewervpn.cat
            • Path \??\c:\users\admin\appdata\roaming\ehome\x64\teamviewervpn.cat
            • Size 10KB
            • SHA256 aa7c09a817eb54e3cc5c342454608364a679e231824f83ba5a2d0278edcc1851
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            teamviewervpn.sys
            • Path \??\c:\users\admin\appdata\roaming\ehome\x64\teamviewervpn.sys
            • Size 34KB
            • SHA256 b8e555d92440bf93e3b55a66e27cef936477ef7528f870d3b78bd3b294a05cc0
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rdpwrap.dll
            • Path \??\c:\windows\system32\rdpwrap.dll
            • Size 114KB
            • SHA256 798af20db39280f90a1d35f2ac2c1d62124d1f5218a2a0fa29d87a13340bd3e4
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            rdpwrap.ini
            • Path \??\c:\windows\system32\rdpwrap.ini
            • Size 27KB
            • SHA256 db1d30ec1fcec8186b0ec01b8a2984244b3393dd7883be442d983aa4cbf29814
            • MD5 SHA1 SHA512 SSDEEP TLSH
            Submit Download

            memory/1404-92-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/1404-91-0x0000000000400000-0x000000000041B000-memory.dmp
            Download

            memory/1820-193-0x0000000007000000-0x0000000007010000-memory.dmp
            Download

            memory/1820-181-0x00000000069A0000-0x00000000069A3000-memory.dmp
            Download

            memory/1820-172-0x0000000007000000-0x0000000007010000-memory.dmp
            Download

            memory/1820-179-0x0000000006990000-0x0000000006993000-memory.dmp
            Download

            memory/1820-178-0x0000000004270000-0x0000000004297000-memory.dmp
            Download

            memory/1820-183-0x0000000006F50000-0x0000000006FBB000-memory.dmp
            Download

            memory/1820-184-0x00000000069A0000-0x00000000069A3000-memory.dmp
            Download

            memory/2440-112-0x0000000007000000-0x0000000007010000-memory.dmp
            Download

            memory/2440-173-0x0000000007000000-0x0000000007010000-memory.dmp
            Download

            memory/2440-135-0x0000000006B30000-0x0000000006B33000-memory.dmp
            Download

            memory/2440-137-0x0000000006BB0000-0x0000000006C1B000-memory.dmp
            Download

            memory/2440-140-0x0000000006C20000-0x0000000006C23000-memory.dmp
            Download

            memory/2440-143-0x0000000006C20000-0x0000000006C23000-memory.dmp
            Download

            memory/2440-127-0x0000000004280000-0x00000000042A7000-memory.dmp
            Download

            memory/2440-115-0x0000000007000000-0x0000000007010000-memory.dmp
            Download

            memory/2720-131-0x0000000007000000-0x0000000007010000-memory.dmp
            Download