Edit tour

Windows Analysis Report
TeamViewer_Setup.exe

Overview

General Information

Sample name:	TeamViewer_Setup.exe
Analysis ID:	1454831
MD5:	7dd4249d398182c34691d1161d844eee
SHA1:	ca3da851cf5871c4580fa8e86b95c2c400258906
SHA256:	2e547f6118a778517fdd883c127c5e427c205a35208267014cce6fe49b63a2b3
Infos:

Detection

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Compliance

Score:	48
Range:	0 - 100

Signatures

Allocates memory in foreign processes

Changes security center settings (notifications, updates, antivirus, firewall)

Tries to harvest and steal browser information (history, passwords, etc)

Uses schtasks.exe or at.exe to add and modify task schedules

Writes a notice file (html or txt) to demand a ransom

Writes to foreign memory regions

Allocates memory with a write watch (potentially for evading sandboxes)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains capabilities to detect virtual machines

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Detected TCP or UDP traffic on non-standard ports

Drops PE files

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

May sleep (evasive loops) to hinder dynamic analysis

Queries disk information (often used to detect virtual machines)

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Queries the volume information (name, serial number etc) of a device

Queries time zone information

Registers a DLL

Sigma detected: Installation of TeamViewer Desktop

Sigma detected: Office Autorun Keys Modification

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: TeamViewer Remote Session

Stores files to the Windows start menu directory

Uses 32bit PE files

Classification

Process Tree

System is w10x64_ra

TeamViewer_Setup.exe (PID: 4072 cmdline: "C:\Users\user\Desktop\TeamViewer_Setup.exe" MD5: 7DD4249D398182C34691D1161D844EEE)

TeamViewer_.exe (PID: 5672 cmdline: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" MD5: 9BAACAEAC47AAB1242A9D56A8291E3C4)

schtasks.exe (PID: 6984 cmdline: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 6992 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TeamViewer_Service.exe (PID: 1240 cmdline: "C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe" -install MD5: E61BE4384327DF6AC8087803A7904BFD)

conhost.exe (PID: 7032 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TeamViewer.exe (PID: 6316 cmdline: "C:\Program Files (x86)\TeamViewer\TeamViewer.exe" api --install MD5: DFA1EDAEE9FCC286C1AD2CD2EF600908)

regsvr32.exe (PID: 2736 cmdline: "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TeamViewer\outlook\TeamViewerMeetingAddinShim.dll" MD5: 878E47C8656E53AE8A8A21E927C6F7E0)

schtasks.exe (PID: 3412 cmdline: C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 3836 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 1376 cmdline: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6292 cmdline: C:\Windows\System32\svchost.exe -k NetworkService -p MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

SgrmBroker.exe (PID: 6328 cmdline: C:\Windows\system32\SgrmBroker.exe MD5: 3BA1A18A0DC30A0545E7765CB97D8E63)

svchost.exe (PID: 6372 cmdline: C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6416 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 6584 cmdline: C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

MpCmdRun.exe (PID: 1732 cmdline: "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable MD5: B3676839B2EE96983F9ED735CD044159)

conhost.exe (PID: 3312 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

svchost.exe (PID: 6680 cmdline: C:\Windows\system32\svchost.exe -k UnistackSvcGroup MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

svchost.exe (PID: 5696 cmdline: C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc MD5: B7F884C1B74A263F746EE12A5F7C9F6A)

TeamViewer_Service.exe (PID: 3316 cmdline: "C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe" MD5: E61BE4384327DF6AC8087803A7904BFD)

TeamViewer.exe (PID: 2708 cmdline: "C:\Program Files (x86)\TeamViewer\TeamViewer.exe" MD5: DFA1EDAEE9FCC286C1AD2CD2EF600908)

chrome.exe (PID: 4472 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.teamviewer.com/documents/?lng=en&version=15.3.8497%20&cid=295016706 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

chrome.exe (PID: 5016 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1960,i,12863219482279789888,7413247670318756557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 83395EAB5B03DEA9720F8D7AC0D15CAA)

tv_w32.exe (PID: 3776 cmdline: "C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer15_Logfile.log MD5: E1506CA998F9DF296D8876E52C67524C)

tv_x64.exe (PID: 3916 cmdline: "C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer15_Logfile.log MD5: 375704CC129FC32235A1A1318042504C)

cleanup

Sigma Signatures

Sigma detected: Installation of TeamViewer Desktop

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe, ProcessId: 5672, TargetFilename: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe

Sigma detected: Office Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: , EventID: 13, EventType: SetValue, Image: C:\Windows\SysWOW64\regsvr32.exe, ProcessId: 2736, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Office\Outlook\Addins\TeamViewerMeetingAddIn.AddIn\Description

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F, CommandLine: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe, ParentProcessId: 5672, ParentProcessName: TeamViewer_.exe, ProcessCommandLine: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F, ProcessId: 6984, ProcessName: schtasks.exe

Sigma detected: TeamViewer Remote Session

Source: File created

Author: Florian Roth (Nextron Systems): Data: EventID: 11, Image: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe, ProcessId: 1240, TargetFilename: C:\Users\user\AppData\Roaming\TeamViewer\TeamViewer15_Logfile.log

Sigma detected: Windows Processes Suspicious Parent Directory

Source: Process started

Author: vburov: Data: Command: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, CommandLine|base64offset|contains: , Image: C:\Windows\System32\svchost.exe, NewProcessName: C:\Windows\System32\svchost.exe, OriginalFileName: C:\Windows\System32\svchost.exe, ParentCommandLine: , ParentImage: , ParentProcessId: 660, ProcessCommandLine: C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS, ProcessId: 1376, ProcessName: svchost.exe

Snort Signatures

⊘No Snort rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

Compliance

Uses 32bit PE files

Source: TeamViewer_Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

File created: C:\Users\user\AppData\Local\Temp\TeamViewer\TV15Install.log

PE / OLE file has a valid certificate

Source: TeamViewer_Setup.exe

Static PE information: certificate valid

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49738 version: TLS 1.2

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TeamViewer_Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Spreading

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\Documents\desktop.ini

Networking

Detected TCP or UDP traffic on non-standard ports

Source: global traffic

TCP traffic: 192.168.2.17:49720 -> 188.172.233.172:5938

Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.211.108
Source: unknown	TCP traffic detected without corresponding DNS query: 192.229.221.95
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 40.127.169.103
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	TCP traffic detected without corresponding DNS query: 199.232.214.172
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200
Source: unknown	TCP traffic detected without corresponding DNS query: 204.79.197.200

Source: global traffic	DNS traffic detected: DNS query: router13.teamviewer.com
Source: global traffic	DNS traffic detected: DNS query: download.teamviewer.com
Source: global traffic	DNS traffic detected: DNS query: www.teamviewer.com
Source: global traffic	DNS traffic detected: DNS query: client.teamviewer.com
Source: global traffic	DNS traffic detected: DNS query: assets.adobedtm.com
Source: global traffic	DNS traffic detected: DNS query: www.google.com
Source: global traffic	DNS traffic detected: DNS query: cdn.cookielaw.org
Source: global traffic	DNS traffic detected: DNS query: s7g10.scene7.com
Source: global traffic	DNS traffic detected: DNS query: teamviewer.scene7.com

Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443

Uses secure TLS version for HTTPS connections

Source: unknown	HTTPS traffic detected: 40.127.169.103:443 -> 192.168.2.17:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 204.79.197.200:443 -> 192.168.2.17:49738 version: TLS 1.2

E-Banking Fraud

Drops certificate files (DER)

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\tvmonitor.cat	Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

File dropped: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\Lizenz_TeamViewer_EN_unicode.txt -> encrypted connections (handshake) and for the forwarding of data packets (routing) in connection with the use of the software ("server services"), and (iii) related support services ("support services"). the server services and the support services are collectively referred to herein as "services".1.2.formation and content of the contract for subscription and perpetual licenses. a paid contract pursuant to this eula for subscription and perpetual software licenses shall be formed, if (i) the customer consummates the web-based order process on the teamviewer website (www.teamviewer.com) and, at the end, clicks on the "purchase" / "order" / "subscribe" or similarly named button after having accepted this eula, or if (ii) the customer and teamviewer sign a written order form which references this eula, or if (iii) the customer orders by phone and receives an order confirmation attaching the eula by e-mail. details regarding the contract (e.g. selected software, scope of functions, price, term, services

Jump to dropped file

System Summary

Creates files inside the system directory

Source: C:\Windows\System32\svchost.exe	File created: C:\Windows\ServiceProfiles\LocalService\AppData\Local\FontCache\Fonts\Download-1.tmp
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Windows\Fonts\teamviewer15.otf
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches

Uses 32bit PE files

Source: TeamViewer_Setup.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE

Source: classification engine

Classification label: mal64.rans.spyw.evad.winEXE@36/98@15/46

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

File created: C:\Program Files (x86)\TeamViewer

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

File created: C:\Users\Public\Desktop\TVTest.tmp

Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Mutant created: \Sessions\1\BaseNamedObjects\C__Program Files (x86)_TeamViewer_TeamViewer.exe
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6992:120:WilError_03
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Mutant created: \BaseNamedObjects\Global\TeamViewer_AssignmentTrigger_Mtx
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Mutant created: \Sessions\1\BaseNamedObjects\TeamViewer_Win32_Instance_Mutex
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Mutant created: \BaseNamedObjects\Local\TeamViewer_LogMutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3836:120:WilError_03
Source: C:\Program Files (x86)\TeamViewer\tv_w32.exe	Mutant created: \Sessions\1\BaseNamedObjects\TeamViewerHooks_Loader_w32
Source: C:\Program Files (x86)\TeamViewer\tv_x64.exe	Mutant created: \Sessions\1\BaseNamedObjects\TeamViewerHooks_Loader_x64
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Mutant created: \Sessions\1\BaseNamedObjects\TeamViewer_DynGateInstanceMutex
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Mutant created: \BaseNamedObjects\Global\TeamViewer_LogMutex
Source: C:\Program Files (x86)\TeamViewer\tv_w32.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\TeamViewer_LogMutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7032:120:WilError_03
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Mutant created: \Sessions\1\BaseNamedObjects\TeamViewer3_Win32_Instance_Mutex

Source: C:\Users\user\Desktop\TeamViewer_Setup.exe

File created: C:\Users\user\AppData\Local\Temp\nsqC3E4.tmp

Source: TeamViewer_Setup.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\TeamViewer_Setup.exe

File read: C:\Users\desktop.ini

Source: C:\Users\user\Desktop\TeamViewer_Setup.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion RegisteredOrganization

Source: C:\Users\user\Desktop\TeamViewer_Setup.exe

File read: C:\Users\user\Desktop\TeamViewer_Setup.exe

Source: unknown	Process created: C:\Users\user\Desktop\TeamViewer_Setup.exe "C:\Users\user\Desktop\TeamViewer_Setup.exe"
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Process created: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe"
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe "C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe" -install
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Program Files (x86)\TeamViewer\TeamViewer.exe "C:\Program Files (x86)\TeamViewer\TeamViewer.exe" api --install
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k netsvcs -p -s BITS
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k NetworkService -p
Source: unknown	Process created: C:\Windows\System32\SgrmBroker.exe C:\Windows\system32\SgrmBroker.exe
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s StorSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s UsoSvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted -p -s wscsvc
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k UnistackSvcGroup
Source: unknown	Process created: C:\Windows\System32\svchost.exe C:\Windows\system32\svchost.exe -k netsvcs -p -s wlidsvc
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe "C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe" -install
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TeamViewer\outlook\TeamViewerMeetingAddinShim.dll"
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe "C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe"
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process created: C:\Program Files (x86)\TeamViewer\TeamViewer.exe "C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process created: C:\Program Files (x86)\TeamViewer\tv_w32.exe "C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer15_Logfile.log
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process created: C:\Program Files (x86)\TeamViewer\tv_x64.exe "C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer15_Logfile.log
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.teamviewer.com/documents/?lng=en&version=15.3.8497%20&cid=295016706
Source: C:\Program Files\Google\Chrome\Application\chrome.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 --field-trial-handle=1960,i,12863219482279789888,7413247670318756557,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files\Windows Defender\MpCmdRun.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TeamViewer\outlook\TeamViewerMeetingAddinShim.dll"
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\System32\svchost.exe	Process created: C:\Program Files\Windows Defender\MpCmdRun.exe "C:\Program Files\Windows Defender\mpcmdrun.exe" -wdenable
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process created: C:\Program Files (x86)\TeamViewer\TeamViewer.exe "C:\Program Files (x86)\TeamViewer\TeamViewer.exe"
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process created: C:\Program Files (x86)\TeamViewer\tv_w32.exe "C:\Program Files (x86)\TeamViewer\tv_w32.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer15_Logfile.log
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process created: C:\Program Files (x86)\TeamViewer\tv_x64.exe "C:\Program Files (x86)\TeamViewer\tv_x64.exe" --action hooks --log C:\Program Files (x86)\TeamViewer\TeamViewer15_Logfile.log
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.teamviewer.com/documents/?lng=en&version=15.3.8497%20&cid=295016706

Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: userenv.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: apphelp.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: propsys.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: oleacc.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: version.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: shfolder.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: wldp.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: dwmapi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: cryptbase.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: oleacc.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: shfolder.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: profapi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: riched20.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: usp10.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msls31.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: textinputframework.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: coreuicomponents.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: coremessaging.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: ntmarta.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wintypes.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: secur32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: sspicli.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: winsta.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: firewallapi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: dnsapi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: fwbase.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: fwpolicyiomgr.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: linkinfo.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: ntshrui.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: srvcli.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: cscapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: qmgr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsperf.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: firewallapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: esent.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsigd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upnp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ssdpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: urlmon.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: srvcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmauto.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: miutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wsmsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsrole.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pcwum.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wkscli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usermgrcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: coremessaging.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: twinapi.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: resourcepolicyclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vssapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vsstrace.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: samlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: es.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bitsproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mpr.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: moshost.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapsbtsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mosstorage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ztrace_maps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcp47langs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mapconfiguration.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fltlib.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: bcd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wer.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: appxdeploymentclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: storageusage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userenv.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: propsys.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usosvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: updatepolicy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cabinet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: taskschd.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: upshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usocoreps.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: usoapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostservice.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: networkhelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdataplatformhelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccspal.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: umpdc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: syncutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: vaultcli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcfgutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wintypes.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmcmnutils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dmxmlhelputils.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: inproclogger.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: flightsettings.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.networking.connectivity.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iertutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msv1_0.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntlmshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptdll.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: synccontroller.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: aphostclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: accountaccessor.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dsclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: powrprof.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: systemeventsbrokerclient.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatalanguageutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mccsengineshared.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: pimstore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cemapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: userdatatypehelperutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: phoneutil.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntmarta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: onecorecommonproxystub.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: execmodelproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rmclient.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wlidsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncrypt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: profapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: clipc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptsp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ntasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wldp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rsaenh.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptbase.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: windows.storage.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msxml6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msasn1.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winhttp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: netprofm.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: iphlpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: policymanager.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msvcp110_win.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: wtsapi32.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winsta.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gamestreamingext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: msauserext.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: tbs.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: npmproxy.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ondemandconnroutehelper.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: sspicli.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc6.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dhcpcsvc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: webio.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mswsock.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: winnsi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: dnsapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: rasadhlp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: fwpuclnt.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: schannel.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: mskeyprotect.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: gpapi.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptnet.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: ncryptsslp.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elscore.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: elstrans.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: cryptngc.dll
Source: C:\Windows\System32\svchost.exe	Section loaded: devobj.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: windows.storage.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: wldp.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: kernel.appcore.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: uxtheme.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: propsys.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: profapi.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: msasn1.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: cryptsp.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: rsaenh.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: cryptbase.dll
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Section loaded: gpapi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: windows.staterepositoryps.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: windows.fileexplorer.common.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: iertutil.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: dwrite.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: wtsapi32.dll
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Section loaded: msi.dll

Source: C:\Users\user\Desktop\TeamViewer_Setup.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Source: C:\Users\user\Desktop\TeamViewer_Setup.exe

File written: C:\Users\user\AppData\Local\Temp\TeamViewer\tvinfo.ini

Checks if Microsoft Office is installed

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\24.0\Outlook

PE / OLE file has a valid certificate

Source: TeamViewer_Setup.exe

Static PE information: certificate valid

Submission file is bigger than most known malware samples

Source: TeamViewer_Setup.exe

Static file information: File size 26985448 > 1048576

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: TeamViewer_Setup.exe

Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Data Obfuscation

Registers a DLL

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TeamViewer\outlook\TeamViewerMeetingAddinShim.dll"

Persistence and Installation Behavior

Drops PE files

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\TvGetVersion.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to dropped file
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\linker.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\FindProcDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\UAC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to dropped file
Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	File created: C:\Users\user\AppData\Local\Temp\nslC462.tmp\TvGetVersion.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to dropped file

Drops files with a non-matching file extension (content does not match file extension)

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_			Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_			Jump to dropped file

Creates install or setup log file

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

File created: C:\Users\user\AppData\Local\Temp\TeamViewer\TV15Install.log

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F

Stores files to the Windows start menu directory

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TVTest.tmp
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File created: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer.lnk

Hooking and other Techniques for Hiding and Protection

Source: C:\Users\user\Desktop\TeamViewer_Setup.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\svchost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX

Malware Analysis System Evasion

Allocates memory with a write watch (potentially for evading sandboxes)

Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe

Memory allocated: 9440000 memory reserve | memory write watch

Contains capabilities to detect virtual machines

Source: C:\Windows\System32\svchost.exe

File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#4&1656f219&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}

Contains long sleeps (>= 3 min)

Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe

Thread delayed: delay time: 922337203685477

Found dropped PE file which has not been started or loaded

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\linker.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\FindProcDLL.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\UAC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to dropped file

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\System32\svchost.exe TID: 6156	Thread sleep time: -30000s >= -30000s
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe TID: 2272	Thread sleep time: -922337203685477s >= -30000s

Queries disk information (often used to detect virtual machines)

Source: C:\Windows\System32\svchost.exe

File opened: PhysicalDrive0

Queries sensitive Operating System Information (via WMI, Win32_ComputerSystem, often done to detect virtual machines)

Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	WMI Queries: IWbemServices::ExecQuery - ROOT\CIMV2 : SELECT * FROM Win32_ComputerSystemProduct

Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Windows\System32\svchost.exe	File Volume queried: C:\Windows\System32 FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File Volume queried: C:\ FullSizeInformation
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File Volume queried: C:\ FullSizeInformation

Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\AppData\Local
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\Desktop\desktop.ini
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\AppData
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\AppData\Local\Temp
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	File opened: C:\Users\user\Documents\desktop.ini

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Process information queried: ProcessInformation

HIPS / PFW / Operating System Protection Evasion

Allocates memory in foreign processes

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Memory allocated: C:\Program Files (x86)\TeamViewer\TeamViewer.exe base: 51D0000 protect: page read and write

Writes to foreign memory regions

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Memory written: C:\Program Files (x86)\TeamViewer\TeamViewer.exe base: 51D0000
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Memory written: C:\Program Files (x86)\TeamViewer\TeamViewer.exe base: 53082D8
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Memory written: C:\Program Files (x86)\TeamViewer\TeamViewer.exe base: 53091E8

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe "C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe" -install
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\regsvr32.exe "C:\Windows\system32\regsvr32.exe" /s "C:\Program Files (x86)\TeamViewer\outlook\TeamViewerMeetingAddinShim.dll"
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	Process created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://www.teamviewer.com/documents/?lng=en&version=15.3.8497%20&cid=295016706

Language, Device and Operating System Detection

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.log VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\edb.chk VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.jfm VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ProgramData\Microsoft\Network\Downloader\qmgr.db VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Windows\System32\svchost.exe	Queries volume information: C: VolumeInformation
Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe	Queries volume information: C:\ VolumeInformation

Queries time zone information

Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

Key value queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\TimeZoneInformation TimeZoneKeyName

Source: C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Lowering of HIPS / PFW / Operating System Security Settings

Changes security center settings (notifications, updates, antivirus, firewall)

Source: C:\Windows\System32\svchost.exe

Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center cval

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'
Source: C:\Windows\System32\svchost.exe	WMI Queries: IWbemServices::ExecNotificationQuery - ROOT\SecurityCenter : SELECT * FROM __InstanceOperationEvent WHERE TargetInstance ISA 'AntiVirusProduct' OR TargetInstance ISA 'FirewallProduct' OR TargetInstance ISA 'AntiSpywareProduct'

Stealing of Sensitive Information

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\arvhxlpc.default\prefs.js
Source: C:\Program Files (x86)\TeamViewer\TeamViewer.exe	File opened: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\8h0a78bs.default-release\prefs.js

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	2 Windows Management Instrumentation	1 Scheduled Task/Job	211 Process Injection	22 Masquerading	1 OS Credential Dumping	1 System Time Discovery	Remote Services	1 Data from Local System	2 Encrypted Channel	Exfiltration Over Other Network Medium	1 Data Encrypted for Impact
Credentials	Domains	Default Accounts	1 Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Scheduled Task/Job	1 Disable or Modify Tools	LSASS Memory	4 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 Registry Run Keys / Startup Folder	61 Virtualization/Sandbox Evasion	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	211 Process Injection	NTDS	61 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	2 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Regsvr32	LSA Secrets	1 System Owner/User Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	Compile After Delivery	DCSync	34 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery

Source	Detection	Scanner	Label	Link
TeamViewer_Setup.exe	0%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\InstallOptions.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\System.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\TvGetVersion.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\UserInfo.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\linker.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nslC462.tmp\TvGetVersion.dll	2%	ReversingLabs
C:\Program Files (x86)\TeamViewer\Printer\x64\TeamViewer_XPSDriverFilter.dll (copy)	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exe	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	2%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.exe	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.dll	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.exe	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\uninstall.exe	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	0%	ReversingLabs
C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\FindProcDLL.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\UAC.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsArray.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsExec.dll	0%	ReversingLabs
C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsis7z.dll	0%	ReversingLabs

Name	IP	Active	Malicious	Reputation
www.google.com	142.250.186.36	true	false	unknown
routerpool13.rlb.teamviewer.com	188.172.233.172	true	false	unknown
cdn.cookielaw.org	104.19.177.52	true	false	unknown
assets.adobedtm.com	unknown	unknown	false	unknown
router13.teamviewer.com	unknown	unknown	false	unknown
www.teamviewer.com	unknown	unknown	true	unknown
teamviewer.scene7.com	unknown	unknown	false	unknown
client.teamviewer.com	unknown	unknown	false	unknown
s7g10.scene7.com	unknown	unknown	false	unknown
download.teamviewer.com	unknown	unknown	false	unknown

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.46	unknown	United States	15169	GOOGLEUS	false
1.1.1.1	unknown	Australia	13335	CLOUDFLARENETUS	false
20.79.107.7	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.186.36	www.google.com	United States	15169	GOOGLEUS	false
2.16.202.128	unknown	European Union	16625	AKAMAI-ASUS	false
104.19.177.52	cdn.cookielaw.org	United States	13335	CLOUDFLARENETUS	false
173.194.76.84	unknown	United States	15169	GOOGLEUS	false
2.19.104.72	unknown	European Union	16625	AKAMAI-ASUS	false
188.172.233.172	routerpool13.rlb.teamviewer.com	Austria	42473	AS-ANEXIAANEXIAInternetdienstleistungsGmbHAT	false
20.190.159.75	unknown	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
2.19.104.20	unknown	European Union	16625	AKAMAI-ASUS	false
239.255.255.250	unknown	Reserved	unknown	unknown	false
104.16.63.16	unknown	United States	13335	CLOUDFLARENETUS	false
104.16.62.16	unknown	United States	13335	CLOUDFLARENETUS	false
23.211.8.123	unknown	United States	16625	AKAMAI-ASUS	false
172.217.18.99	unknown	United States	15169	GOOGLEUS	false

Private

IP
192.168.2.17
127.0.0.1

General Information

Joe Sandbox version:	40.0.0 Tourmaline
Analysis ID:	1454831
Start date and time:	2024-06-10 23:27:15 +02:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsinteractivecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	38
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	EGA enabled
Analysis Mode:	stream
Analysis stop reason:	Timeout
Sample name:	TeamViewer_Setup.exe
Detection:	MAL
Classification:	mal64.rans.spyw.evad.winEXE@36/98@15/46
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, SIHClient.exe, SgrmBroker.exe, MoUsoCoreWorker.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 20.190.159.75, 20.190.159.71, 20.190.159.4, 20.190.159.64, 20.190.159.23, 40.126.31.67, 40.126.31.71, 20.190.159.2
Excluded domains from analysis (whitelisted): fs.microsoft.com, slscr.update.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Timeout during stream target processing, analysis might miss dynamic analysis data
VT rate limit hit for: TeamViewer_Setup.exe

Created / dropped Files

C:\Program Files (x86)\TeamViewer\CopyRights.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E6875A4A62E57DBB66F071CAA853F281
SHA1:	78FA5A447A63768983836C67B94A63AE7F13F4BB
SHA-256:	F77B387824B0A7272225DAA7DF4AC845CD183D75E7CBD6013498BA7BB0A6EE64
SHA-512:	C6B6DB19CD11C9C4A264D8ADA3DC4721B9E0E8E74B709CAA11A8A785494E1884B38C4288B37DC06E824669B5DE142B0FB0FA99FA7B88D339EE0953667D1CD696
Malicious:	false
Reputation:	unknown
Preview:	TEAMVIEWER COPYRIGHT ..====================..see License.txt......THIRD-PARTY COPYRIGHTS OF INTEGRATED COMPONENTS..===============================================....Copyright (c) 2007 Henri Torgemane..All Rights Reserved.....BigInteger, RSA, Random and ARC4 are derivative works of the jsbn library..(http://www-cs-students.stanford.edu/~tjw/jsbn/)..The jsbn library is Copyright (c) 2003-2005 Tom Wu (tjw@cs.Stanford.EDU)....MD5, SHA1, and SHA256 are derivative works (http://pajhome.org.uk/crypt/md5/)..Those are Copyright (c) 1998-2002 Paul Johnston & Contributors (paj@pajhome.org.uk)....SHA256 is a derivative work of jsSHA2 (http://anmar.eu.org/projects/jssha2/)..jsSHA2 is Copyright (c) 2003-2004 Angel Marin (anmar@gmx.net)....AESKey is a derivative work of aestable.c (http://www.geocities.com/malbrain/aestable_c.html)..aestable.c is Copyright (c) Karl Malbrain (malbrain@yahoo.com)....BlowFishKey, DESKey and TripeDESKey are derivative works of the Bouncy Castle Crypto Package ..(http:/

C:\Program Files (x86)\TeamViewer\CopyRights_DE.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	A7DDE0BE757C9FD8B3BD4A7AF6A95439
SHA1:	B797FCEE144F193488D0CB792FFD62F0626F17CA
SHA-256:	0452616496679ADA598A7FE7B36058BAF0FDA5E747D45727544B8EC224B19CFA
SHA-512:	1B58FAAEA79AA60F4CEA481CB4837DD6FA4837D2FF39D52F7877C87EE8398BC4A1D5E052AD1031C337E4704BB129B8F2B21828EDDF2CC26E0CA9FA2CC8FE987E
Malicious:	false
Reputation:	unknown
Preview:	COPYRIGHT TEAMVIEWER..====================..siehe Lizenz.txt......COPYRIGHTS INTEGRIERTER KOMPONENTEN..===================================....Copyright (c) 2007 Henri Torgemane..All Rights Reserved.....BigInteger, RSA, Random and ARC4 are derivative works of the jsbn library..(http://www-cs-students.stanford.edu/~tjw/jsbn/)..The jsbn library is Copyright (c) 2003-2005 Tom Wu (tjw@cs.Stanford.EDU)....MD5, SHA1, and SHA256 are derivative works (http://pajhome.org.uk/crypt/md5/)..Those are Copyright (c) 1998-2002 Paul Johnston & Contributors (paj@pajhome.org.uk)....SHA256 is a derivative work of jsSHA2 (http://anmar.eu.org/projects/jssha2/)..jsSHA2 is Copyright (c) 2003-2004 Angel Marin (anmar@gmx.net)....AESKey is a derivative work of aestable.c (http://www.geocities.com/malbrain/aestable_c.html)..aestable.c is Copyright (c) Karl Malbrain (malbrain@yahoo.com)....BlowFishKey, DESKey and TripeDESKey are derivative works of the Bouncy Castle Crypto Package ..(http://www.bouncycastle.org)..

C:\Program Files (x86)\TeamViewer\CopyRights_EN.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E6875A4A62E57DBB66F071CAA853F281
SHA1:	78FA5A447A63768983836C67B94A63AE7F13F4BB
SHA-256:	F77B387824B0A7272225DAA7DF4AC845CD183D75E7CBD6013498BA7BB0A6EE64
SHA-512:	C6B6DB19CD11C9C4A264D8ADA3DC4721B9E0E8E74B709CAA11A8A785494E1884B38C4288B37DC06E824669B5DE142B0FB0FA99FA7B88D339EE0953667D1CD696
Malicious:	false
Reputation:	unknown
Preview:	TEAMVIEWER COPYRIGHT ..====================..see License.txt......THIRD-PARTY COPYRIGHTS OF INTEGRATED COMPONENTS..===============================================....Copyright (c) 2007 Henri Torgemane..All Rights Reserved.....BigInteger, RSA, Random and ARC4 are derivative works of the jsbn library..(http://www-cs-students.stanford.edu/~tjw/jsbn/)..The jsbn library is Copyright (c) 2003-2005 Tom Wu (tjw@cs.Stanford.EDU)....MD5, SHA1, and SHA256 are derivative works (http://pajhome.org.uk/crypt/md5/)..Those are Copyright (c) 1998-2002 Paul Johnston & Contributors (paj@pajhome.org.uk)....SHA256 is a derivative work of jsSHA2 (http://anmar.eu.org/projects/jssha2/)..jsSHA2 is Copyright (c) 2003-2004 Angel Marin (anmar@gmx.net)....AESKey is a derivative work of aestable.c (http://www.geocities.com/malbrain/aestable_c.html)..aestable.c is Copyright (c) Karl Malbrain (malbrain@yahoo.com)....BlowFishKey, DESKey and TripeDESKey are derivative works of the Bouncy Castle Crypto Package ..(http:/

C:\Program Files (x86)\TeamViewer\Lizenz_TeamViewer_DE_unicode.txt (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1644), with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	DC2173761DFCCC73431D65243E915534
SHA1:	A4077CD6D9FBE09DC11C8B069F7B557296BAFD86
SHA-256:	C7C09996DBA39C3755D3361CBCCE9514CFB81BA0A4D7A4EEB384D0E918EF066E
SHA-512:	056D42833C60B488873714C49E1FEFBFCB39C420170058FACD0A4421EAFFB5C90BB77FA268577D50A2C1C4A4A1156C598BAD48C9DF615082F5A2DC395AF50CC2
Malicious:	false
Reputation:	unknown
Preview:	..T.e.a.m.V.i.e.w.e.r... .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g.............B.e.f.i.n.d.e.n. .s.i.c.h. .d.e.r. .O.r.t. .d.e.s. .E.r.w.e.r.b.s. .o.d.e.r. .I.h.r. .H.a.u.p.t.(.w.o.h.n.).s.i.t.z. .a.u...e.r.h.a.l.b. .d.e.r. .U.S.A.,. .S...d.a.m.e.r.i.k.a. .o.d.e.r. .K.a.n.a.d.a.,. .g.e.l.t.e.n. .f...r. .u.n.s.e.r. .g.e.m.e.i.n.s.a.m.e.s. .V.e.r.t.r.a.g.s.v.e.r.h...l.t.n.i.s. .d.i.e. .B.e.s.t.i.m.m.u.n.g.e.n. .d.e.r. .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g. .u.n.t.e.r. .A... .u.n.d. .C...........B.e.f.i.n.d.e.t. .s.i.c.h. .d.e.r. .O.r.t. .d.e.s. .E.r.w.e.r.b.s. .o.d.e.r. .I.h.r. .H.a.u.p.t.(.w.o.h.n.).s.i.t.z. .i.n. .d.e.n. .U.S.A.,. .S...d.a.m.e.r.i.k.a. .o.d.e.r. .i.n. .K.a.n.a.d.a.,. .g.e.l.t.e.n. .f...r. .u.n.s.e.r. .g.e.m.e.i.n.s.a.m.e.s. .V.e.r.t.r.a.g.s.v.e.r.h...l.t.n.i.s. .d.i.e. .B.e.s.t.i.m.m.u.n.g.e.n. .d.e.r. .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g. .u.n.t.e.r. .B... .u.n.d. .C...........D.i.e. .E.n.d.b.e.n.u.t.z.

C:\Program Files (x86)\TeamViewer\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	DD9E53811E13C519EFC63B810A09F755
SHA1:	470769B8AE317D5C297E5A25FC8DEE1FA24F3FC4
SHA-256:	9C1D5F500D11BA903AB68A37A5906A1890A8862F31C77A51ADA88F33E41EC431
SHA-512:	4FB9EA99E652E324F0C67052EA44780A33D41B05C7E6C4DA149610942F1F576931C97BCDEB3B7446F6E026680704370F213C5C8D83AEDF4F649C1AF4A635BC91
Malicious:	false
Reputation:	unknown
Preview:	<Filters>.. <Filter dll = "TeamViewer_XPSDriverFilter.dll".. clsid = "{40D118AB-04EA-4CFC-8C8B-85D1C7ECB046}".. name = "TeamViewer_XPSDriverFilter1">.. <Input guid = "{4d47a67c-66cc-4430-850e-daf466fe5bc4}" comment="IID_IPrintReadStream"/>.. <Output guid = "{65bb7f1b-371e-4571-8ac7-912f510c1a38}" comment="IID_IPrintWriteStream"/>.. </Filter>..</Filters>....

C:\Program Files (x86)\TeamViewer\Printer\TeamViewer_XPSDriverFilter-manifest.ini (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Generic INItialization configuration [DriverRender]
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	54C8E94030311B3D2DD23DA4E9A40B8D
SHA1:	8E68E6F8CC5C8F23AC479E24924184F8B9EA7BC8
SHA-256:	423A1A4B7615AFCDEBBC8670363F386F81ABB6E545BEAC20ED45798AFF1CF949
SHA-512:	8D5E18D432EEA2B26E915208181A014ECD6BE0490A85B07C9BEDFAB2F2C8BA599FA23B4721FEB8268DC73E7E1DEAC15E42F53318185F5982759B36B5F4C69AFB
Malicious:	false
Reputation:	unknown
Preview:	[DriverConfig]..DataFile=TeamViewer_XPSDriverFilter.gpd..PrinterDriverID={4949F9E6-DB2F-47B7-9489-56815A5847C8}..RequiredFiles=UNIRES.DLL,STDNAMES.GPD,MSXPSINC.GPD..DriverCategory=PrintFax.Printer.Virtual..UserPropertyBagScope=Queue....[DriverRender]..XpsFormat=XPS..

C:\Program Files (x86)\TeamViewer\Printer\TeamViewer_XPSDriverFilter.gpd (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	15FC96E23C7629630ED0EDB3CBB8F9EC
SHA1:	0C652015CC865AB10FA521705AB6FA1B0DAFC52F
SHA-256:	C7A51AF4DC71FED50DC095E5B7B89DE3E07F00D68CBC769D70808FF25CD15502
SHA-512:	534C7289DB4253F1C78575D17FC9E806FA58224345CFF7DC54D7DD1C7A5ED1010DE79932814F29216713531AB7A411E2653106E3533E298EE45A040A2952E748
Malicious:	false
Reputation:	unknown
Preview:	%..% Copyright (c) TeamViewer GmbH..%..% All rights reserved...%....GPDFileVersion: "1.0"..GPDSpecVersion: "1.0"..GPDFileName: "TeamViewer_XPSDriverFilter.GPD"..Include: "StdNames.gpd"..Include: "msxpsinc.gpd"..ModelName: "TeamViewer Printer"..MasterUnits: PAIR(1200, 1200)..PrinterType: PAGE..MaxCopies: 1..PrintSchemaPrivateNamespaceURI:"http://www.teamviewer.com/printschema/2018"....%*****************************************************************************..% Orientation..%****************************************************************************..Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.... Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. }.... Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. }..}....%****************************************************************************..%

C:\Program Files (x86)\TeamViewer\Printer\TeamViewer_XPSDriverFilter.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	01A0E11FB18948F8ACE13B8495031BBA
SHA1:	38262FD955FACDF69AA73CBFBC823BFFCF6C8141
SHA-256:	BEF127CF5C45A03F0294048C47F472A3F242900C89915BEA73450A0F9312330F
SHA-512:	901D7D894C663FC60B623E9CE25F117062F755538EAC32B57EF1F012FD906286848F2EB245A3C625BD7B922F3A74AAEAFA52394FACAE64B37063E5F7A62289D0
Malicious:	false
Reputation:	unknown
Preview:	;..; Copyright (c) 2019 TeamViewer GmbH..;..; All rights reserved...;..[Version]..Signature="$Windows NT$"..Class=Printer..ClassGuid={4d36e979-e325-11ce-bfc1-08002be10318}..Provider=%ManufacturerName%..CatalogFile=TeamViewer_XPSDriverFilter.cat..ClassVer=4.0..DriverVer=11/25/2019,1.2019.1125.989....[DestinationDirs]..DefaultDestDir = 66000....[SourceDisksNames]..1 = ,,,\....[SourceDisksFiles.x86]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x86..TeamViewer_XPSDriverFilter-manifest.ini = 1....[SourceDisksFiles.amd64]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x64..TeamViewer_XPSDriverFilter-manifest.ini = 1....[Manufacturer].."TeamViewer"=TeamViewer,NTamd64.6.1....[TeamViewer].."TeamViewer Printer" = TeamViewer_XPSDriverFilter.gpd,,TeamViewer_XPS_Printer....[TeamViewer.NTamd64.6.1].."TeamViewer Printer" = TeamViewer_XPSDriverFilt

C:\Program Files (x86)\TeamViewer\Printer\teamviewer_xpsdriverfilter.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	CABC504793B33987E4A7C861581AD2FB
SHA1:	4E51A4D7F3E1B82C55496D9024877F9F502E1EB6
SHA-256:	1264A56E7F44A8EE5198E6786FC820F8C55365EB9B603E9E8CDB25183A09F585
SHA-512:	E015DA669BB52DFD651F4E2E52702651EE690634FDF7C07671993EAFC92EAA6CE9C7D1B945602D5E4C70783619A76606C05BD6BD8ABEB4BFF389B75E9C9D0444
Malicious:	false
Reputation:	unknown
Preview:	0.,...*.H........+.0.+....1.0...+......0.."..+.....7......0...0...+.....7.....V.Z....L.e....u{..191125153003Z0...+.....7.....0..I0....R0.C.6.5.2.0.1.5.C.C.8.6.5.A.B.1.0.F.A.5.2.1.7.0.5.A.B.6.F.A.1.B.0.D.A.F.C.5.2.F...1..A02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+.........e ..Z...!pZ....../0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...g.p.d...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R3.8.2.6.2.F.D.9.5.5.F.A.C.D.F.6.9.A.A.7.3.C.B.F.B.C.8.2.3.B.F.F.C.F.6.C.8.1.4.1...1..A02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........8&/.U.....<...;..l.A0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R4.7.0.7.6.9.B.8.A.E.3.1.7.D.5.C.2.9.7.E

C:\Program Files (x86)\TeamViewer\Printer\x64\TeamViewer_XPSDriverFilter.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	329FA5F95141CBAC808CCA6A0E8278B0
SHA1:	EC22610A7552E3DD57E94A003D6E63B57021CB23
SHA-256:	F835CE4D3C8BFBEEE3B88C5B44ABC8968BA8147F1E1329D14442C0B7763352C0
SHA-512:	34B5EB8F5F3F29BAEE2623025FCDE6A7A71DAAAA31275956A1810ABB45455CA98E0C60046C90E942377B7C9113C0037F329883D76A5A634B910932DD930E7AE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........S.e...e...e.......e.......e.......e.......e.......e.......e.......e.......e...e..+e.......e.......e.......e...ea..e.......e..Rich.e..........................PE..d...x..].........." ................................................................L....`.........................................@................... .... ..XV...\..........x...@T..p....................U..(....T...............................................text............................... ..`.rdata..............................@..@.data....N.......8..................@....pdata..XV... ...X..................@..@_RDATA...............B..............@..@.rsrc... ............D..............@..@.reloc..x............J..............@..B........................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\CopyRights_DE.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	52962
Entropy (8bit):	5.066512888922843
Encrypted:	false
SSDEEP:
MD5:	A7DDE0BE757C9FD8B3BD4A7AF6A95439
SHA1:	B797FCEE144F193488D0CB792FFD62F0626F17CA
SHA-256:	0452616496679ADA598A7FE7B36058BAF0FDA5E747D45727544B8EC224B19CFA
SHA-512:	1B58FAAEA79AA60F4CEA481CB4837DD6FA4837D2FF39D52F7877C87EE8398BC4A1D5E052AD1031C337E4704BB129B8F2B21828EDDF2CC26E0CA9FA2CC8FE987E
Malicious:	false
Reputation:	unknown
Preview:	COPYRIGHT TEAMVIEWER..====================..siehe Lizenz.txt......COPYRIGHTS INTEGRIERTER KOMPONENTEN..===================================....Copyright (c) 2007 Henri Torgemane..All Rights Reserved.....BigInteger, RSA, Random and ARC4 are derivative works of the jsbn library..(http://www-cs-students.stanford.edu/~tjw/jsbn/)..The jsbn library is Copyright (c) 2003-2005 Tom Wu (tjw@cs.Stanford.EDU)....MD5, SHA1, and SHA256 are derivative works (http://pajhome.org.uk/crypt/md5/)..Those are Copyright (c) 1998-2002 Paul Johnston & Contributors (paj@pajhome.org.uk)....SHA256 is a derivative work of jsSHA2 (http://anmar.eu.org/projects/jssha2/)..jsSHA2 is Copyright (c) 2003-2004 Angel Marin (anmar@gmx.net)....AESKey is a derivative work of aestable.c (http://www.geocities.com/malbrain/aestable_c.html)..aestable.c is Copyright (c) Karl Malbrain (malbrain@yahoo.com)....BlowFishKey, DESKey and TripeDESKey are derivative works of the Bouncy Castle Crypto Package ..(http://www.bouncycastle.org)..

C:\Program Files (x86)\TeamViewer\TVExtractTemp\CopyRights_EN.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	52982
Entropy (8bit):	5.067377884226257
Encrypted:	false
SSDEEP:
MD5:	E6875A4A62E57DBB66F071CAA853F281
SHA1:	78FA5A447A63768983836C67B94A63AE7F13F4BB
SHA-256:	F77B387824B0A7272225DAA7DF4AC845CD183D75E7CBD6013498BA7BB0A6EE64
SHA-512:	C6B6DB19CD11C9C4A264D8ADA3DC4721B9E0E8E74B709CAA11A8A785494E1884B38C4288B37DC06E824669B5DE142B0FB0FA99FA7B88D339EE0953667D1CD696
Malicious:	false
Reputation:	unknown
Preview:	TEAMVIEWER COPYRIGHT ..====================..see License.txt......THIRD-PARTY COPYRIGHTS OF INTEGRATED COMPONENTS..===============================================....Copyright (c) 2007 Henri Torgemane..All Rights Reserved.....BigInteger, RSA, Random and ARC4 are derivative works of the jsbn library..(http://www-cs-students.stanford.edu/~tjw/jsbn/)..The jsbn library is Copyright (c) 2003-2005 Tom Wu (tjw@cs.Stanford.EDU)....MD5, SHA1, and SHA256 are derivative works (http://pajhome.org.uk/crypt/md5/)..Those are Copyright (c) 1998-2002 Paul Johnston & Contributors (paj@pajhome.org.uk)....SHA256 is a derivative work of jsSHA2 (http://anmar.eu.org/projects/jssha2/)..jsSHA2 is Copyright (c) 2003-2004 Angel Marin (anmar@gmx.net)....AESKey is a derivative work of aestable.c (http://www.geocities.com/malbrain/aestable_c.html)..aestable.c is Copyright (c) Karl Malbrain (malbrain@yahoo.com)....BlowFishKey, DESKey and TripeDESKey are derivative works of the Bouncy Castle Crypto Package ..(http:/

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Lizenz_TeamViewer_DE_unicode.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1644), with CRLF line terminators
Category:	dropped
Size (bytes):	221916
Entropy (8bit):	3.3897639680275384
Encrypted:	false
SSDEEP:
MD5:	DC2173761DFCCC73431D65243E915534
SHA1:	A4077CD6D9FBE09DC11C8B069F7B557296BAFD86
SHA-256:	C7C09996DBA39C3755D3361CBCCE9514CFB81BA0A4D7A4EEB384D0E918EF066E
SHA-512:	056D42833C60B488873714C49E1FEFBFCB39C420170058FACD0A4421EAFFB5C90BB77FA268577D50A2C1C4A4A1156C598BAD48C9DF615082F5A2DC395AF50CC2
Malicious:	false
Reputation:	unknown
Preview:	..T.e.a.m.V.i.e.w.e.r... .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g.............B.e.f.i.n.d.e.n. .s.i.c.h. .d.e.r. .O.r.t. .d.e.s. .E.r.w.e.r.b.s. .o.d.e.r. .I.h.r. .H.a.u.p.t.(.w.o.h.n.).s.i.t.z. .a.u...e.r.h.a.l.b. .d.e.r. .U.S.A.,. .S...d.a.m.e.r.i.k.a. .o.d.e.r. .K.a.n.a.d.a.,. .g.e.l.t.e.n. .f...r. .u.n.s.e.r. .g.e.m.e.i.n.s.a.m.e.s. .V.e.r.t.r.a.g.s.v.e.r.h...l.t.n.i.s. .d.i.e. .B.e.s.t.i.m.m.u.n.g.e.n. .d.e.r. .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g. .u.n.t.e.r. .A... .u.n.d. .C...........B.e.f.i.n.d.e.t. .s.i.c.h. .d.e.r. .O.r.t. .d.e.s. .E.r.w.e.r.b.s. .o.d.e.r. .I.h.r. .H.a.u.p.t.(.w.o.h.n.).s.i.t.z. .i.n. .d.e.n. .U.S.A.,. .S...d.a.m.e.r.i.k.a. .o.d.e.r. .i.n. .K.a.n.a.d.a.,. .g.e.l.t.e.n. .f...r. .u.n.s.e.r. .g.e.m.e.i.n.s.a.m.e.s. .V.e.r.t.r.a.g.s.v.e.r.h...l.t.n.i.s. .d.i.e. .B.e.s.t.i.m.m.u.n.g.e.n. .d.e.r. .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g. .u.n.t.e.r. .B... .u.n.d. .C...........D.i.e. .E.n.d.b.e.n.u.t.z.

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	438
Entropy (8bit):	4.95090866009145
Encrypted:	false
SSDEEP:
MD5:	DD9E53811E13C519EFC63B810A09F755
SHA1:	470769B8AE317D5C297E5A25FC8DEE1FA24F3FC4
SHA-256:	9C1D5F500D11BA903AB68A37A5906A1890A8862F31C77A51ADA88F33E41EC431
SHA-512:	4FB9EA99E652E324F0C67052EA44780A33D41B05C7E6C4DA149610942F1F576931C97BCDEB3B7446F6E026680704370F213C5C8D83AEDF4F649C1AF4A635BC91
Malicious:	false
Reputation:	unknown
Preview:	<Filters>.. <Filter dll = "TeamViewer_XPSDriverFilter.dll".. clsid = "{40D118AB-04EA-4CFC-8C8B-85D1C7ECB046}".. name = "TeamViewer_XPSDriverFilter1">.. <Input guid = "{4d47a67c-66cc-4430-850e-daf466fe5bc4}" comment="IID_IPrintReadStream"/>.. <Output guid = "{65bb7f1b-371e-4571-8ac7-912f510c1a38}" comment="IID_IPrintWriteStream"/>.. </Filter>..</Filters>....

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Generic INItialization configuration [DriverRender]
Category:	dropped
Size (bytes):	267
Entropy (8bit):	5.343872848979328
Encrypted:	false
SSDEEP:
MD5:	54C8E94030311B3D2DD23DA4E9A40B8D
SHA1:	8E68E6F8CC5C8F23AC479E24924184F8B9EA7BC8
SHA-256:	423A1A4B7615AFCDEBBC8670363F386F81ABB6E545BEAC20ED45798AFF1CF949
SHA-512:	8D5E18D432EEA2B26E915208181A014ECD6BE0490A85B07C9BEDFAB2F2C8BA599FA23B4721FEB8268DC73E7E1DEAC15E42F53318185F5982759B36B5F4C69AFB
Malicious:	false
Reputation:	unknown
Preview:	[DriverConfig]..DataFile=TeamViewer_XPSDriverFilter.gpd..PrinterDriverID={4949F9E6-DB2F-47B7-9489-56815A5847C8}..RequiredFiles=UNIRES.DLL,STDNAMES.GPD,MSXPSINC.GPD..DriverCategory=PrintFax.Printer.Virtual..UserPropertyBagScope=Queue....[DriverRender]..XpsFormat=XPS..

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	66207
Entropy (8bit):	4.1122293623093
Encrypted:	false
SSDEEP:
MD5:	15FC96E23C7629630ED0EDB3CBB8F9EC
SHA1:	0C652015CC865AB10FA521705AB6FA1B0DAFC52F
SHA-256:	C7A51AF4DC71FED50DC095E5B7B89DE3E07F00D68CBC769D70808FF25CD15502
SHA-512:	534C7289DB4253F1C78575D17FC9E806FA58224345CFF7DC54D7DD1C7A5ED1010DE79932814F29216713531AB7A411E2653106E3533E298EE45A040A2952E748
Malicious:	false
Reputation:	unknown
Preview:	%..% Copyright (c) TeamViewer GmbH..%..% All rights reserved...%....GPDFileVersion: "1.0"..GPDSpecVersion: "1.0"..GPDFileName: "TeamViewer_XPSDriverFilter.GPD"..Include: "StdNames.gpd"..Include: "msxpsinc.gpd"..ModelName: "TeamViewer Printer"..MasterUnits: PAIR(1200, 1200)..PrinterType: PAGE..MaxCopies: 1..PrintSchemaPrivateNamespaceURI:"http://www.teamviewer.com/printschema/2018"....%*****************************************************************************..% Orientation..%****************************************************************************..Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.... Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. }.... Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. }..}....%****************************************************************************..%

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1508
Entropy (8bit):	5.240060884454191
Encrypted:	false
SSDEEP:
MD5:	01A0E11FB18948F8ACE13B8495031BBA
SHA1:	38262FD955FACDF69AA73CBFBC823BFFCF6C8141
SHA-256:	BEF127CF5C45A03F0294048C47F472A3F242900C89915BEA73450A0F9312330F
SHA-512:	901D7D894C663FC60B623E9CE25F117062F755538EAC32B57EF1F012FD906286848F2EB245A3C625BD7B922F3A74AAEAFA52394FACAE64B37063E5F7A62289D0
Malicious:	false
Reputation:	unknown
Preview:	;..; Copyright (c) 2019 TeamViewer GmbH..;..; All rights reserved...;..[Version]..Signature="$Windows NT$"..Class=Printer..ClassGuid={4d36e979-e325-11ce-bfc1-08002be10318}..Provider=%ManufacturerName%..CatalogFile=TeamViewer_XPSDriverFilter.cat..ClassVer=4.0..DriverVer=11/25/2019,1.2019.1125.989....[DestinationDirs]..DefaultDestDir = 66000....[SourceDisksNames]..1 = ,,,\....[SourceDisksFiles.x86]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x86..TeamViewer_XPSDriverFilter-manifest.ini = 1....[SourceDisksFiles.amd64]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x64..TeamViewer_XPSDriverFilter-manifest.ini = 1....[Manufacturer].."TeamViewer"=TeamViewer,NTamd64.6.1....[TeamViewer].."TeamViewer Printer" = TeamViewer_XPSDriverFilter.gpd,,TeamViewer_XPS_Printer....[TeamViewer.NTamd64.6.1].."TeamViewer Printer" = TeamViewer_XPSDriverFilt

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	11268
Entropy (8bit):	6.909253370828322
Encrypted:	false
SSDEEP:
MD5:	CABC504793B33987E4A7C861581AD2FB
SHA1:	4E51A4D7F3E1B82C55496D9024877F9F502E1EB6
SHA-256:	1264A56E7F44A8EE5198E6786FC820F8C55365EB9B603E9E8CDB25183A09F585
SHA-512:	E015DA669BB52DFD651F4E2E52702651EE690634FDF7C07671993EAFC92EAA6CE9C7D1B945602D5E4C70783619A76606C05BD6BD8ABEB4BFF389B75E9C9D0444
Malicious:	false
Reputation:	unknown
Preview:	0.,...*.H........+.0.+....1.0...+......0.."..+.....7......0...0...+.....7.....V.Z....L.e....u{..191125153003Z0...+.....7.....0..I0....R0.C.6.5.2.0.1.5.C.C.8.6.5.A.B.1.0.F.A.5.2.1.7.0.5.A.B.6.F.A.1.B.0.D.A.F.C.5.2.F...1..A02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+.........e ..Z...!pZ....../0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...g.p.d...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R3.8.2.6.2.F.D.9.5.5.F.A.C.D.F.6.9.A.A.7.3.C.B.F.B.C.8.2.3.B.F.F.C.F.6.C.8.1.4.1...1..A02..+.....7...1$0"...O.S.A.t.t.r........2.:.6...1...0E..+.....7...17050...+.....7.......0!0...+........8&/.U.....<...;..l.A0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...i.n.f...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R4.7.0.7.6.9.B.8.A.E.3.1.7.D.5.C.2.9.7.E

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	752128
Entropy (8bit):	6.527150652524626
Encrypted:	false
SSDEEP:
MD5:	329FA5F95141CBAC808CCA6A0E8278B0
SHA1:	EC22610A7552E3DD57E94A003D6E63B57021CB23
SHA-256:	F835CE4D3C8BFBEEE3B88C5B44ABC8968BA8147F1E1329D14442C0B7763352C0
SHA-512:	34B5EB8F5F3F29BAEE2623025FCDE6A7A71DAAAA31275956A1810ABB45455CA98E0C60046C90E942377B7C9113C0037F329883D76A5A634B910932DD930E7AE0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$..........S.e...e...e.......e.......e.......e.......e.......e.......e.......e.......e...e..+e.......e.......e.......e...ea..e.......e..Rich.e..........................PE..d...x..].........." ................................................................L....`.........................................@................... .... ..XV...\..........x...@T..p....................U..(....T...............................................text............................... ..`.rdata..............................@..@.data....N.......8..................@....pdata..XV... ...X..................@..@_RDATA...............B..............@..@.rsrc... ............D..............@..@.reloc..x............J..............@..B........................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	49966712
Entropy (8bit):	6.632842783291361
Encrypted:	false
SSDEEP:
MD5:	DFA1EDAEE9FCC286C1AD2CD2EF600908
SHA1:	B41BAA85C234823AA6F49E4DB70FBF5BDE3DFFB7
SHA-256:	70B7612B6B9E9EB0C7FD24A20BAB06121F0E50CE6AA5DE2C46646B8739471869
SHA-512:	EE889232485D0C0871AC88E5C023D9ECDE4B5998389EE902CFF5110A874D18FED38D047598768CEC4113FE28DE30837A9979158F1B4229B0C1B88DBAB4C03DDC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$.......(Z..l;..l;..l;...]...;..riv.m;...$.i;..>S..O;..>S..D;...]..A;..>S...;...]..o;..6....;...R..u;...]..n;..l;..h?...]..k;...R..w:...R..?;...MH.n;...R..d9...]..W;...R..e;..l;..A?...R..8-...R..m;..l;t.m;...R..m;..Richl;..........................PE..L....&f^.................ZM.........P........pM...@..........................@......_.....@.....................................(....P...............4..x:......d9 ..-..T....................-........].@............pM.........@....................text....XM......ZM................. ..`.rdata....l..pM...l..^M.............@..@.data........0......................@....didat...............&..............@....rodata.@.... .......4..............@..@_RDATA.......0.......@..............@..@.rsrc........P.......R..............@..@.reloc..d9 ......: .................@..B................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer15.otf

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	2572
Entropy (8bit):	5.4588336400576205
Encrypted:	false
SSDEEP:
MD5:	E8FDF1CFD4547B86CA2C2296349ACB54
SHA1:	692A2BD8CCE1C4AC62F7CD505907AA8E21AB3B69
SHA-256:	26061147867A2C3267378A97F3897C0E3187A81B987FE8FBA570A37E1305D50B
SHA-512:	8E7F26D7F3936411446A3F2D48EA7429CFA72F229DC85C4E441F7CD6B1F91EBC90A8784854784E0F42D7E0CF3B74D9B510118E37921F37190E160B6392192634
Malicious:	false
Reputation:	unknown
Preview:	OTTO.......0CFF ......(...(FFTM{..6...x....GDEF.'.D...P...&OS/2..... ...`cmapqxM.........head.iO........6hhea.Y.5.......$hmtxP'.`.......xmaxp..P.........name..=.........post...2....... ........8..._.<..........W.......z.............................Z...........................P................................1..............................PfEd...7.w. .8.Z................. . ...................6...........k...........................................................I.........4.............Q...........x.........0...................................../.C.r.e.a.t.e.d. .b.y. .T.e.a.m.V.i.e.w.e.r. .G.m.b.H..Created by TeamViewer GmbH..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15..M.e.d.i.u.m..Medium..T.e.a.m.V.i.e.w.e.r.1.5. .:. .2.7.-.9.-.2.0.1.9..TeamViewer15 : 27-9-2019..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15..V.e.r.s.i.o.n. .0.1.5...1.0. ..Version 015.10 ..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15....................\|...........`...........8.T.V.a.e.i.m.r.w.....7.A.V.a.e.i.m.r.w..................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	10965008
Entropy (8bit):	6.666995655062423
Encrypted:	false
SSDEEP:
MD5:	3B2A468CD816CF7355E6765CDD98D1AD
SHA1:	7073C97CD7EDED5F1F85092D6C975080B58EBBC0
SHA-256:	B8F2D68CA22DCE6570AEDFB71FE0176876F29A053DB19338C145CBFEC58B32F9
SHA-512:	4FDCE3D189734044847E4393F9197F5A4613C4C420BCCD89671ED7A5D642672BF60F7FD06A8121FC011FEE8820674B2D564B68F235D82D9D00A09B6D9F60A251
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......M.~.............l..............#......[.......[.......l.......[.......l...)...l.......l.......SF..u...............e......................,.......Z.......;.......O...........................Rich....................PE..L....!f^......................$.....PTw......@....@.................................c....@.....................................(....0...f...........2...........N.....T...................$......8..@............@...... ...`....................text............................... ..`.orpc...f....0...................... ..`.rdata.......@......................@..@.data....>.........................@....didat..0............h..............@....rodata.@.... .......n..............@..@.rsrc....f...0...h...z..............@..@.reloc...N.......P.................@..B........................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1403408
Entropy (8bit):	6.422663984691022
Encrypted:	false
SSDEEP:
MD5:	2BDBB7391BB20EFF464C223597DE8DF8
SHA1:	96C1705E72A410A092C171DC9B8AF46F9B99552B
SHA-256:	C4C4B8C28C23576E5DC7A3061B85A67117407669272E42CD376350ED247A834E
SHA-512:	64B6D18181C10877E06F469F85D0A244D27575B3D793C1AB06600F653CC58EB638188D6F067FA38C4AF60777CCEB122BB2D025AD0EB395B111F7615B4700DB3F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?...{.s.{.s.{.s...p.m.s...v..s.).p.c.s.).w.Z.s.).v...s...w.a.s...r.x.s...v.U.s.{.r.".s.!I..s.s.{.s.R.s...z.(.s....z.s.{...z.s...q.z.s.Rich{.s.........PE..L.....f^..........................................@..................................B....@.....................................(.......H{...........L..........<...0...T...............................@...............L...\...`....................text............................... ..`.rdata..............................@..@.data............f..................@....didat..d....p......."..............@....rsrc...H{.......\|...$..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	312848
Entropy (8bit):	4.218102390482508
Encrypted:	false
SSDEEP:
MD5:	167BADB41DEC5E511618F7DD92B71843
SHA1:	F4798E2901DFA6E397655DD69921CBEAC539CCE7
SHA-256:	37492C85452064FDFF267361C4A642E89851E9BF9C56C2A7C0AE734B96888E8D
SHA-512:	9DF8804357ACA240F328D2A3528E8E252B604E90FF011BC85F3008EE9E841B3FCFEC14D2B42EFE4820FB84056FA61396C2A7AA5CA37E08DD5BBF1E785CD9E4D3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...w3f^...........!......................................................................@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....w3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...p...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	367632
Entropy (8bit):	4.174097140262507
Encrypted:	false
SSDEEP:
MD5:	97811671330F434CF31F635A0FD8A7F8
SHA1:	F7BB8533E03959107DA36895F1992E7503D074CB
SHA-256:	137D78509647B17E2CBFC844048EC73A4A455ED15B869784D0E8D05CFC3EFB49
SHA-512:	D22A33B0A5A31A5563610B22D0560DF9369D9A09C9F2AA3B0992EF429525137B55AAA814877AD0F4789B445B5506FA678EA4358DDAE7EEC1FE1992F0FECA9950
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........\|...........................................................@.......................................... ...y...........~...............................................................................................rdata..p...........................@..@.rsrc....y... ...z..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..PF...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	341520
Entropy (8bit):	3.875685878810989
Encrypted:	false
SSDEEP:
MD5:	524FAC87CC47DD324952E5D7E09CFBA0
SHA1:	DDB692A9D80ADCCEA3E93A40A2B6CD60F475DAD7
SHA-256:	04ED2D65375871F10BDAA4BBF691D79E39A9649074DAF8C67D836F6A74750618
SHA-512:	65510E259874A7D2009DBE0E5AFD3EAD4253AAD7D1564D8F6F1BD518E5170207E7DC66908CB37DD77D2A9FE45AFCD944EFB6FAB59AC8F9FED6B33E9DBF6B2D06
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...n3f^...........!.........................................................@......7.....@.......................................... ..P............................................................................................................rdata..p...........................@..@.rsrc...P.... ......................@..@....n3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	335376
Entropy (8bit):	3.6158658686854332
Encrypted:	false
SSDEEP:
MD5:	664032E52DAE0F05C80F3946E8470DED
SHA1:	48D6200B262DD25321A2EEA77B4E94EBF58E3E0D
SHA-256:	A747C3C47A64C3864634A4F269E5062C8A38EE22987BCD21DA6AB6D744DA9962
SHA-512:	D2000CDC481F10CD183E4F764265068B212EE6D897D7819D31FC1894C61182A717ED5C09D0788C3C2D46C2B3D2AA2D74E4C63116099A080174A43586F9F2282A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...33f^...........!......................................................... ............@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....33f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	377360
Entropy (8bit):	3.6048766908014427
Encrypted:	false
SSDEEP:
MD5:	6F433ED2A921D8DB9416E5B2A87E4F66
SHA1:	8AF34B426FD656097842F7D0920CC8AA4BBD0517
SHA-256:	1A54411EFB23A94DE49AB57C6DA74CA7459C733571C85796D6F468E8B942CB35
SHA-512:	AF8408C567E9D1C5D70CA5498497707D7697034A52494B3778CBEFF5C0704C3AE3FF7FD024E5B4762B4C56E4A447FD284AF55D4A672A1D34DCC95DA124EB56F3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!................................................................`\|....@.......................................... ..P............................................................................................................rdata..p...........................@..@.rsrc...P.... ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...j...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	406032
Entropy (8bit):	4.2965980073112116
Encrypted:	false
SSDEEP:
MD5:	AFF078431E8360F25B7725093BFE42A3
SHA1:	EF5F67EA730B15AB53DC5F57BB67E0C4F1039B83
SHA-256:	5633A8D2C7A4AD487636CAD6D8F53CFEC9D070825AFE3BFEEB74F8DAA1E26DD9
SHA-512:	94EBAA891340FD7FBD9726A4B86621B93C00B3400913107F08430E71EE9B054E91CF8FD259C70AD41280F2312A25ADAE2464F7D50FEC0DC1A806C5334DB22245
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........................................................0.......;....@.......................................... ..x............................................................................................................rdata..p...........................@..@.rsrc...x.... ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328720
Entropy (8bit):	3.59957785061539
Encrypted:	false
SSDEEP:
MD5:	CABD7ADDF8623E1B9216F1F22C202A6F
SHA1:	587906217A8119C54FB39F041FCC81FE835F6BC4
SHA-256:	3E5E4ADEDF07E8069E34C33FE2CAF0721D01A2DE8CA605EAB1E7551A0BE1C6FF
SHA-512:	D931A4C1CA5092A37A48DB3E88E263A2124C233E955E53288DE743DC1B6080FB6516BFBD2662A843D1B9977C8D853B7AAE4A9EF788FCC5501173A8A309E480F9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.................................................................%....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	374800
Entropy (8bit):	3.5368580459460803
Encrypted:	false
SSDEEP:
MD5:	615F901221BEB951E4979E7065605837
SHA1:	0F9E907B28BB0417003F996948B4F90BA73F3A99
SHA-256:	175CB99157B5F53293C02CDD84395952D96C9AD6B3AA964782AE5520753342A5
SHA-512:	44A466596A4AB8729D0B57F87F6B73C3094B81B86F02734B0E7A7FEFC5C3A9DA060E609987A6C80A8FB45F9AB6465197BFE8D478F33DF94F67EAAC510F9E87A4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...D3f^...........!.................................................................'....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....D3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...`...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	339984
Entropy (8bit):	3.5872557660765487
Encrypted:	false
SSDEEP:
MD5:	538533B20B29FF4CB5173E8036F20900
SHA1:	6DEA3B561EE7C71FED08DB4F25C548B34EDDC2D8
SHA-256:	B437CDCA33067C756A43553D5992C602792DDE956CC97E8856303C1BCE906F64
SHA-512:	001874ADB60ABECCF8DD5C466CC033C257573D60913748966B3DDCD3B8075078854A932352914931BC5C8DDCC7981FFE31C59D09B567CF4F9C4ADEF6F917E313
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....4f^...........!.........................................................0......x6....@.......................................... ..8............................................................................................................rdata..p...........................@..@.rsrc...8.... ......................@..@.....4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	394256
Entropy (8bit):	3.56671475044173
Encrypted:	false
SSDEEP:
MD5:	D778D0CE59B9A39EF6073AA6EF66C858
SHA1:	FFF2331D827270FF0B6FC027CC51C6B7934134FA
SHA-256:	229F50C0AFFDCD133BB2076B18CDA1C02094AB084CEDD20BDD69E48D2BB7AB7A
SHA-512:	A101EECBF7EB58B97D790BF133CF753BD5581AFD5F186806C2EF4216D484756E5B7FA2166FEE97556C21A37C0B709BAB0DF157B53B916CF5CC677E771E3C2C35
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L..."3f^...........!................................................................wi....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@...."3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	273424
Entropy (8bit):	4.350128571932348
Encrypted:	false
SSDEEP:
MD5:	EC8A38B3FD8C06EAEE82349202985BFB
SHA1:	EA708D27313541B4E49897E6629B3EF561536A40
SHA-256:	EFD255D8D2794232FC71A5CDB296172B7898523001D3AC6F9AE79DE793363070
SHA-512:	95CAA516E39F149BBDC125935192299DC75BF958386B1513E9C2BFBC263FB8B1EFA62D1493A235A169953FEF231FBF50991AA3100F696C65C134B244DE3D7C36
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........................................................0............@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	356368
Entropy (8bit):	3.665807987196205
Encrypted:	false
SSDEEP:
MD5:	FCFEF1E4825BE7184C6CC29943D76D8F
SHA1:	1AC6E010A40A24EB2F29FA00108F2E9A594C4507
SHA-256:	C48B6E2A9E200B68E52317E902E9BB57D88FD43402FB836DE91DEB4C802768D4
SHA-512:	AAF1C36F2ABFBF036E2D4C69FEBE60510B79FD580C255767A47467451B2D4F4B10DAC98AB380DB883D23E8C6BF0CD4DC17DD37536490C3090A1952AF269DEFEE
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........P...............................................p............@.......................................... ...M...........R...............................................................................................rdata..p...........................@..@.rsrc....M... ...N..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..8....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	368144
Entropy (8bit):	3.754068032470802
Encrypted:	false
SSDEEP:
MD5:	1F50C2C7670D3CDA50C3A364F9ED2845
SHA1:	A6E51D2E1D24A614A02B6ED5B5242076A4039E71
SHA-256:	A903CA331A20930C00AF86AA4A0FD999017CFD218C58DB3B91B7D99FEDB5CF5F
SHA-512:	8098583489F9E6F44D50DA80E2067D70F0952C7B6386B2D68FBBBCA09469BBA9CEF03411E5F290C002E522FFD1C1D96F3E2D4C2D79B0BA93D7999F181CEEBA63
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........~.......................................................@....@.......................................... ...{...........................................................................................................rdata..p...........................@..@.rsrc....{... ...\|..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..(H...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	344592
Entropy (8bit):	3.5612053813431825
Encrypted:	false
SSDEEP:
MD5:	9961D60FF798FA926381C75799AB65C2
SHA1:	67D979BBAB1D6FF1F943721C5B017662DFFE7524
SHA-256:	B38B4FAA87D047C142AA907E484B3E37AB041A7F65D2F45E2AE71D540CFBDAC3
SHA-512:	3D42C3FC94964216FF92784E7D895B4F50FC3F3F44C2031226E7B3F093F6E1F98D1C7A32EB817749998BA2001F27EF4470950D552F638B619F3CF6B07084B926
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!........."...............................................@.......w....@.......................................... ..0............$...............................................................................................rdata..p...........................@..@.rsrc...0.... ... ..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	374288
Entropy (8bit):	3.5388569462098016
Encrypted:	false
SSDEEP:
MD5:	281510B470F12C36DAA9872443BE98EB
SHA1:	91C9B77BA9B5298B9CCC5B2114153BD97CE69E9D
SHA-256:	EB24146A9FE319310370A520C363450069FE3331931CF1D5A1FEC41570768FB4
SHA-512:	046D4696A7C08CC036B7A7ECE9D269BFCDE8832C1101E5AAA0529EBCB61AF126815105F71E254A00182D9DFF8C49C1D5B504827C3F86C6C94F9B2F19AC2AFD12
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...+3f^...........!.................................................................-....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....+3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..._...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	203280
Entropy (8bit):	5.490240474108758
Encrypted:	false
SSDEEP:
MD5:	72CD78EBB2F7401E455627E3B8A18582
SHA1:	A54F9B3C215314793F9EEDBE696AAE34484F20C6
SHA-256:	F25C1489BD2F5AE2F3A1A678C829F283EF20EC2AFEE33FAEFB9BCCD0FCE84E95
SHA-512:	3773EE1F1A5E2B4B6E1959664ED567A66D8AD36EC1DD853D4B3E541576459654F2419D4529FEB60AB26D36D536B5FD154B33B535F0C367D4C63DB08B9A6AB11A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...f3f^...........!......................................................... ............@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....f3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	197648
Entropy (8bit):	5.636298649299781
Encrypted:	false
SSDEEP:
MD5:	2A0DCF7A95802524F33E6F7B15B48F0A
SHA1:	5B64ACABDED58148A397D3EDC82F8D5EE3183601
SHA-256:	7EF5EB8B86A8060D5539971DB7D198E747C6DD55415A08F4133D406C170F6797
SHA-512:	304198454EAC9FEF7246BA8A14B48CCDFA1BE34D22B2A4AB5580271DE3572ABA97435F3DA499F8E0B2476B88A4885DEB741092180346DA1AEBBB88C5E59D88CD
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...U3f^...........!................................................................~.....@.......................................... ..0............................................................................................................rdata..p...........................@..@.rsrc...0.... ......................@..@....U3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	365584
Entropy (8bit):	3.753713752418
Encrypted:	false
SSDEEP:
MD5:	7C154C044B0E8A67AEE9FFA721A3DFDE
SHA1:	D5B14DFEE963A5D9358527A59696647291F2DAF5
SHA-256:	67307BE5A7A35C0BBBF7058A5BDC5022A6664BE8E7AD4E4ED5F274F2A723C364
SHA-512:	240583BA0235C0C2E13D72C9AA4D4C8D0BCCE65096C554BABD390B8E7A7F2F3ADDA7D7EFCE68B6861D6BBAA96E7FF463AC0F968D654111470E7D9933F375B71C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........t......................................................M\|....@.......................................... ..Pq...........v...............................................................................................rdata..p...........................@..@.rsrc...Pq... ...r..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...=...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	363536
Entropy (8bit):	3.557138467357997
Encrypted:	false
SSDEEP:
MD5:	33F20D0326410AF0DAA3EF26FD8DFC01
SHA1:	32F36F0305983A13E40B251DF3207BA535344490
SHA-256:	C45AAD18F79FADFAEC4A8396CCF42320642DE0709BFABD1C51C5D3D629B6E6AD
SHA-512:	3EF05E67F8EBCBBDBCA9CFEBD9F9640CC152FE6948A60CF7399B8E6B1DFB513F09721AE86FFF1DFC14CFB5BA77AF73BE2A2BCA86C30B5960A5E3FB11FE648AD3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...;3f^...........!.........l............................................................@.......................................... ...i...........n...............................................................................................rdata..p...........................@..@.rsrc....i... ...j..................@..@....;3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...5...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334352
Entropy (8bit):	3.6033400762053014
Encrypted:	false
SSDEEP:
MD5:	6394396382A2EA3557B462610024141B
SHA1:	CE1B4DF9CB26CACABB384EAD3CCB5C934E8F8B62
SHA-256:	9612DA4D29048AC283DE67D98E03AD2B5D67D178C1BB3BBB517F393E14D5F9B8
SHA-512:	460680FA6926405648653613B0B1E0C0922B2475ACBB63BE3E5B77BD5605594A8DBAB105953B3B7DDB78F0176F0F044496F80B7D20869214722E87E964B8E32B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....4f^...........!......................................................... ......-q....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	366608
Entropy (8bit):	3.8127656770638656
Encrypted:	false
SSDEEP:
MD5:	0D71B70B206BFED2F637B486BC1218F6
SHA1:	DFA1A8C8F3143F2F06FFCC88BA2B0DA479593AEE
SHA-256:	F51ED8CF0EB16F807FE45F078D1A226DE4DE9E9BC5ABD6C0C003A8A21EB273DA
SHA-512:	BDF0D6A3B30883DF47FCE11190CDA948C183F14D4DCD32E4479E1EDEA4585CEA157E82E14D41C81D0F7DBAE8745876FCDE60BA7ECD9E6061CA3D6B4F48226DCC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........x......................................................d3....@.......................................... ...t...........z...............................................................................................rdata..p...........................@..@.rsrc....t... ...v..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..PA...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	358416
Entropy (8bit):	3.591606512833819
Encrypted:	false
SSDEEP:
MD5:	49255B1FE7F3D612217F7DD3B02308BA
SHA1:	1AB10073E923BF8A37F920D6AF040F3647654954
SHA-256:	A945A16BF8A5C3E8D0C14F61FABC4241E94F6921636251FF93A0E47B758D6FC4
SHA-512:	0F1E5203E830E7C0FC85DB12B701ED02E00ACC2F143B5176F421A35398432BEE889F43E84E11D9C8C8E68BE2D59A191142AC3CB3689605CB18761805A3B9456D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...L3f^...........!.........X...........................................................@.......................................... .. U...........Z...............................................................................................rdata..p...........................@..@.rsrc... U... ...V..................@..@....L3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...!...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	384016
Entropy (8bit):	3.6792702789759155
Encrypted:	false
SSDEEP:
MD5:	035A2F432D8032EAF2962EDD6F895056
SHA1:	A277D64A63F6149164C1E37865645F4A03538C83
SHA-256:	75AFDED007062486A155C82E5E8AFAEDE4AA685274B37BAB872257E463FFAE7B
SHA-512:	B10726278E793A86D33F465738F2B0C201762C028965D66BA0E5220956C50B63BBFD551C2020038DD1E27E1C808B76A5E3B80B9744E4B6EE8365FA299D8F26EA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!................................................................q.....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..h....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	362000
Entropy (8bit):	4.249930751108041
Encrypted:	false
SSDEEP:
MD5:	CEF0CA0C674673116BCCA878CDAE250C
SHA1:	19B3FDB53935830DE0741522B8650A839CA2B34A
SHA-256:	873D3B7674BF20AE11FF3510311140919F65C25068F72B043F69291A45F2404A
SHA-512:	764D97F493CFB3B07D5DB74A375E7CB0579B7934D5A735802C31F3C3B6FA5C2F301996CBD3E7995240121200B7843459D9123541D5EEF499B015972644128EE4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...]3f^...........!.........f......................................................o.....@.......................................... ...b...........h...............................................................................................rdata..p...........................@..@.rsrc....b... ...d..................@..@....]3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..P/...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	352784
Entropy (8bit):	3.8156436307030304
Encrypted:	false
SSDEEP:
MD5:	5676AA55DB5F4D15C2C2BD94669AD736
SHA1:	A35BD3FD21D3249C9DC1D0E8EF317680A5F5BF07
SHA-256:	30DB391D6C5C62DC04D2B91DB56484D66AC32EA86BAB002ADF567B23B9347CA6
SHA-512:	24A17602CF67AEBE278C15D77335FE1BF3B701FFB34900D3184892147BBB85E1331B35146D110E2142096BB4BDB00256B80D7198BD2F30F198AA21FAD1F7B313
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........B...............................................`............@.......................................... ..p>...........D...............................................................................................rdata..p...........................@..@.rsrc...p>... ...@..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	353808
Entropy (8bit):	3.6664457315817374
Encrypted:	false
SSDEEP:
MD5:	67AEB735FAFBE7A749BD0641382360F2
SHA1:	DA0B0D3CDB8EA0D41DE63FA19F3F2F87EC5A2FD3
SHA-256:	BB8B2C7136AA6CE56DEEED473F8B2F76E5FA087259D54832270AC96E940DD39F
SHA-512:	6249112D0CFF1239CEC851F0E5B97128FAF260F10994307FAF4B5B8DBBEAE73A64F71AA3AF0C202E2F173CE55B1126C22987F4EA72F9832DB641692A92AB5C54
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........F...............................................p......cc....@.......................................... ..@C...........H...............................................................................................rdata..p...........................@..@.rsrc...@C... ...D..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	334864
Entropy (8bit):	3.652242070673896
Encrypted:	false
SSDEEP:
MD5:	765CF4D5CFC3AC48247D9748654A9403
SHA1:	E1033A93B648CFA8BF518BFA723D1D4ED2425830
SHA-256:	DEAC9381BB13821725CA6AAE8926C43887C02DC560B107436BFDEE747C5AC487
SHA-512:	E403429F14328DE6C92C2836048F40B0F9345D374E9E835CCAA3A93204C9A2B7A5E403EA6C03622D953BC8CE1FE61B4DF589EEB0317E22119BF6A3620338C9D0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...&4f^...........!......................................................... .......}....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....&4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..@....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	328208
Entropy (8bit):	4.417138529793365
Encrypted:	false
SSDEEP:
MD5:	A8860A177599AA4F0E0B399751A0C630
SHA1:	8EF8A1414702BB3C2E592339624585F75C66D77D
SHA-256:	816886CBBDCF7FD501BCD989D54BD7D4991CA6791DB0C1758FC928DA1A351780
SHA-512:	E63074FE7DA0CC30A09640F81C174946B4FD4800DF9469DF060252C0987594B7890C71553A75C691522A42EBCA1DCEDDACA7CDE39237DCD730C94602EB134C7D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.................................................................z....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	343568
Entropy (8bit):	3.819340547220051
Encrypted:	false
SSDEEP:
MD5:	5189E86A5F7D33281B2AFD441A38F42D
SHA1:	958D5150CABF49EA9E83F49859A079D4D07BAA3A
SHA-256:	4D42BAFE63A578ECF17FB579A9DF84C5892C6A0F0F2E8E6C06E9AC1D4EF80A38
SHA-512:	1C14BA4E939C4498665319145BC55705C3CE10E5C22A67EF67E5ACEF4CD73912BC456F91AC16DC57043CF2DE416E74307BAA3C36AD15A714706804264B271836
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........................................................@......l.....@.......................................... ..x............ ...............................................................................................rdata..p...........................@..@.rsrc...x.... ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	360976
Entropy (8bit):	4.269374648882662
Encrypted:	false
SSDEEP:
MD5:	914FF2A3F9183AD59B2B95EA811186B9
SHA1:	D753486E1B74FAD5DD9E4E13C53831F972323888
SHA-256:	B52FB3C0D6DF10A7E1ACE76E60E25CD8050A0493F725C63CFAF686B1132C6725
SHA-512:	22E7DA3BC5B22AF2531D2AFBD4197C01000D41B3AE2A16278EBB92657DD94A2151D3EEE0A9A5CDFE802081E6375770561866C7A728745A4703576F8516688F0A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........b......................................................%.....@.......................................... ...^...........d...............................................................................................rdata..p...........................@..@.rsrc....^... ...`..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..h+...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	373264
Entropy (8bit):	4.042683600773495
Encrypted:	false
SSDEEP:
MD5:	9CB72E2BFD2530E5C2743388CB8D82FD
SHA1:	21C2CCCB40C6D0232741A5E0EACBF3A65E91884F
SHA-256:	43CABAE3789F6FB354B508A9400D95A7E8A04AE3775E889A739642D2BF2717FC
SHA-512:	85D39BF60506115B05C341E28D5F4208EAA492C618C613920E1C2809A344EC5DA50FA540D94749F4A03FA5ECF943163AA78A2FFA5EB4BD99AD8DA32519D1EC13
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....4f^...........!.................................................................q....@.......................................... ..0............................................................................................................rdata..p...........................@..@.rsrc...0.... ......................@..@.....4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...Z...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	149520
Entropy (8bit):	6.131237539691907
Encrypted:	false
SSDEEP:
MD5:	1DF7E62AB680E71E5107BF54850F3AB1
SHA1:	0F32F0C631065E9115E9A76B11D94DDEC14276B2
SHA-256:	B9DA21BC42F11EE2E1EC03B540E7B9B89E3542D1CCC1FEA86A430C5B424D7E3B
SHA-512:	5F5A63B8778764AB5C5A51B7ABACFB8A86F0214C50522906F77F964DCA13A21965B3A4402F2A67FF63B5D6026BB4E0EDFF21A8479265268161C5F0E6684EA804
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........(...............................................P.......,....@.......................................... ...%...........*...............................................................................................rdata..p...........................@..@.rsrc....%... ...&..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	150544
Entropy (8bit):	6.174663336821559
Encrypted:	false
SSDEEP:
MD5:	89D8FFEB80328DCD20B71F7559E1CE93
SHA1:	CAFB42F45C0FF5C7FDE8C7FA2838BD452767975B
SHA-256:	BFF902C1CD97E62D5513E354829618E667F199F3392B964861C06383C6E1FACA
SHA-512:	785FB160DDE16088F30464DE1BDCA110C1C78A6C913D66F644A43757F7ED9008918D5E8BA6ECAFC3664B1A713ECF2AA9CD88E489A7695EE432F104E097EDDA80
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....4f^...........!.........,...............................................P......L.....@.......................................... ..H)...........................................................................................................rdata..p...........................@..@.rsrc...H)... ...*..................@..@.....4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Service.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	13206544
Entropy (8bit):	6.5283535439406375
Encrypted:	false
SSDEEP:
MD5:	E61BE4384327DF6AC8087803A7904BFD
SHA1:	C7E98A3C67B554F3F6FDC30DC1603B14339CE590
SHA-256:	72B4424085E7AF27760328539F651515F8859D5BA3DA68DAD06FDA61C688B5E7
SHA-512:	2BA4F4039B4D280B3EB72A2E904B47D0BA2E8E9BEF7E6DD351BD60DADC2A2E7AB9F44275ADC64E2B1A1F1BC316F0AA90FFC057F05A11D5D455F9A6AB80936B8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......CPN8.1 k.1 k.1 kbW%j.1 k...k.1 kUY#j.1 kUY$j"1 kbW#j.1 kUY%j.1 kbW$j!1 kbW!j.1 k]..k*1 k.1 ky1 kbW&j.1 k.X%jb1 k.X%j.1 k.X$j\|1 k.1!k.3 k.X%j.1 k.X$j.1 k.X)jY4 k.X.k.1 k.1.k.1 k.X"j.1 kRich.1 k................PE..L...."f^......................7......9.......0....@.................................V.....@.....................................(.......`............f...........C...j..T...................4k......P..@............0...............................text............................... ..`.rdata... ..0.... .................@..@.data..............................@....didat.. ...........\|..............@....rsrc...`...........................@..@.reloc...C.......D..."..............@..B................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	8668688
Entropy (8bit):	7.541425656026503
Encrypted:	false
SSDEEP:
MD5:	E7E8598F0B04C986B187096AE0037425
SHA1:	51F828177BC94E1A1381AD3D55E45CC4EA0A4E35
SHA-256:	97ECEDA5246BA241C23C24AC0B8409576AB4A4763976CF302460FC9458C6FA1A
SHA-512:	47267E452F00A8996656F7D2CA75363233D2BA6B086D1FE3A5DFAC2065694AC47D76B1EEB317116410B5A61155EE645A36A9001BAC6AA43146D9032ACB373839
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L.....f^...........!.........&...............................................P......`....@.......................................... ..0#...........(...............................................................................................rdata..p...........................@..@.rsrc...0#... ...$..................@..@......f^........T........................rdata......T....rdata$zzzdbg.... ...+...rsrc$01.....K.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	13840
Entropy (8bit):	6.009690978261161
Encrypted:	false
SSDEEP:
MD5:	6ECD6276A4BE15DD67A79C0AF0B8BECF
SHA1:	37CADD348C7B573E34DDBB94C653CFB7D45B7195
SHA-256:	51895AC6DD35344271207C5BE06BF1F7BC359CF99C5340014359CD26CD980EB5
SHA-512:	2E4DDFEA288664E39EA87B35771B214FE1F2338D8FF128E10FD3A42A382D5ECBD1DFEB7BCE6D4257C1DFD88B12B08D398D6FADF7DE382DBEF6AF6EA8D85E5735
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2f^.........." ..0..............,... ...@....... ...............................U....@..................................+..O....@.......................`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ..0...........................................................0..b.......~.....~......(.....(......o.......(.......o.....0.~....(....,..(....&.~....(....,..(....&.(....&...........%1.0......(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......`...#Blob...........G..........3..................................................-...........................0.......f...\|.f...].f.....f.....f.....f.....f...7.f.........B.....

C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	350224
Entropy (8bit):	6.488742529191819
Encrypted:	false
SSDEEP:
MD5:	55B43A060098C3DF4C42E5D66C4CE307
SHA1:	321DB33F085121674CBE882432CC61C77B82B696
SHA-256:	7E36FE802523BE4750EC3EEB420FA5A67233508A41737BB4B656CB01A96EDFF7
SHA-512:	00D4AF7013BDB13E5491CC1A8A432A8076333B2ECF85220715E762AF2B72FF3B16C9737B48F9C114E52D013CF31EB357CAB654BB9D77BC736412E9731F9F55AC
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2f^...........!.....0...........N... ...`....@.. ...............................[....@..................................M..W.......l............:.......`....................................................... ............... ..H............text........ ...0.................. ..`.reloc.......`.......2..............@..B.rsrc...l............4..............@..@.................M......H............d..........x...([...........................................0..s........(*.....s....}......}......{....{....o....(+...(.....{....{....(=...:}... X.dD(q...(......{....o....}.....{.....{....o....o....o......o........o.... ..dD(q...~,...o-......(........o.......(.... ..dD(q...(....... 5.dD(q...o......o.....o....,$.o......o/...-.....o....(....o....+..o....-....o.....o....(+...,....o.....o........o....u......9<.....o....90....o....o.....Y..-..o.....+?.o....o.....o....

C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	128016
Entropy (8bit):	6.436614407464368
Encrypted:	false
SSDEEP:
MD5:	CF797B1ADCEB2BAF6172506D9C845043
SHA1:	091F44ABEE5FDA49FE18EA226945D9D9178921F5
SHA-256:	B3F2ACAE6BA9EF2C46308E2B43F4C57C49F32BCAFB6E40DDBF3AFE88F4E5859D
SHA-512:	241C70F27F6303D59598C877F5D0F2B5358E1520016C727A7000C4C6DBA051CBC0D14D2EB3C5BF85862B05EB9987818F06520760F5259C77B54337E56B3F3647
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........&..H..H..H...K..H...M.f.H..L...H..K...H..M..H...L...H...I..H......H..I...H.y.M..H.y.L..H.y.H..H.y...H.....H.y.J..H.Rich.H.................PE..L....2f^...........!.....$..........Pn.......@............................................@........................................................................p...T..............................@............@...............................text...0".......$.................. ..`.rdata..vz...@...\|...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	153616
Entropy (8bit):	6.082909722736017
Encrypted:	false
SSDEEP:
MD5:	B6682E2157C0B3E0EC25270875703E4B
SHA1:	DC029C58FC73689BAE7EF8FF05CDCF5C5958D0DA
SHA-256:	DCD932405A77AB199D8B053C7B61A4047913D723F46BEF82FFF984F85D883C45
SHA-512:	D3E45CDBBCBE85C7608DC5D546B086A215DC182FDEBBC3F77E05FFCD743D7A866236BFC46909F80C550B5DD69D09F3D37D912B95F96AA7CF096F17CAA662A4B3
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......py.4...4...4...Q~..1...Q~.....fp..;...fp..<...fp......Q~..9...Q~..8...*J..7...4...L...q..0...q..5...q..5...qc.5...4...5...q..5...Rich4...................PE..d....2f^.........." .....8..........xx..............................................'.....`.................................................<........p.......P.......:..................T............................................P..h............................text....7.......8.................. ..`.rdata..F....P.......<..............@..@.data....$... ......................@....pdata.......P......................@..@.rsrc........p.......(..............@..@.reloc...............2..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	420880
Entropy (8bit):	6.882866318152936
Encrypted:	false
SSDEEP:
MD5:	FB9E6CC8ED7E2390DE074D896D890D02
SHA1:	DFCEC4766BD71B55F5A725F02840203DF9D0D972
SHA-256:	2286A1E1F1F18872C9366F2D19A9ED3421EAD0E9CD09A92365FD3A98CBDE0953
SHA-512:	C08561D7806815D1B4E196ECA2158B780450CEA354E01CE77C2003612C22142C07B01A8EDF4F1C9410384A18AABABA536FB259BE617D8B3E9FF1C656F341A1BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0.EQ..EQ..EQ.. 7..OQ.. 7...Q...9..YQ...9..JQ...9..WQ.. 7..QQ.. 7..HQ..EQ...Q...8..IQ...8..DQ...8A.DQ...8..DQ..RichEQ..................PE..L...7.f^...........!................`...............................................U.....@A........................P...t............`...............N.......p..<8......T...............................@............................................text...e........................... ..`.rdata...P.......R..................@..@.data....$... ......................@....shared.$....P......................@....rsrc........`......................@..@.reloc..<8...p...:..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_w32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1168400
Entropy (8bit):	6.815812671248198
Encrypted:	false
SSDEEP:
MD5:	E1506CA998F9DF296D8876E52C67524C
SHA1:	FC6D4B71D0CB55C2D92939BDADD0135101B8E779
SHA-256:	8D47AFF2E8C53C5E414148706CF9629A8E711D199D404611E7255F26641FCFE4
SHA-512:	5CC208310363340F99863CDA2A24D76371264D53E8352655D403989EB763F1BBF3BF32F3317C68A8CDF09162264690A77C2DA27CF16199B92651F8FB4DA97844
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............vv..vv..vv...u..vv...s.Svv...u..vv...r..vv...r..vv...s.mvv...w..vv.~.s..vv..vw..wv......vv..vv..vv.~....vv.~....vv..v..vv.~.t..vv.Rich.vv.........PE..L.....f^.....................\.......Y............@.......................... .......>....@.................................(...(....P.......................`..X...`s..T....................s.......J..@...............@......@....................text....~.......................... ..`.rdata..\...........................@..@.data...<........f..................@....didat..4....@......................@....rsrc........P......................@..@.reloc..X....`......................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	531472
Entropy (8bit):	6.617428267548962
Encrypted:	false
SSDEEP:
MD5:	6FC3F183F6EDB80173AF596968E411DB
SHA1:	45E15D364EBC549AA520A9E18A1C1D2A6CFE948A
SHA-256:	5AC6FFB4E31E6002A9C4AE2944C8A9E5EF9AC55CCF84BADFFDB9DD58AF006444
SHA-512:	924AE7A504F78248E5F7B94FF2FB104A25C09A4ADC20E1B297D8F0186842CA8D070E51BF8C9396758CEB19109A42667253CBF630EBC4D25E3CF6DC3343B02C4D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s8$.7YJ.7YJ.7YJ.R?I.1YJ.R?O..YJ.e1O.*YJ.e1N.9YJ.e1I.?YJ.R?N.;YJ.R?K.:YJ.7YK..YJ..0B.;YJ..0J.6YJ..0..6YJ..0H.6YJ.Rich7YJ.........................PE..d.....f^.........." ................P........................................p......u.....`A............................................P............P..........tU...........`.. .......T...........................P................................................text............................... ..`.rdata..............................@..@.data...(1..........................@....pdata..tU.......V..................@..@.shared.H....@......................@....rsrc........P......................@..@.reloc.. ....`......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\tv_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1355280
Entropy (8bit):	6.4936017183976045
Encrypted:	false
SSDEEP:
MD5:	375704CC129FC32235A1A1318042504C
SHA1:	A15E218917747840EF9332B215F9B7183139857D
SHA-256:	2CCC9F6D657FFA5DF8AC5734A0DA82CC6CB7302B7141909D2C1A1A5A148FE135
SHA-512:	93A07AE4E47626F48E8BC6F3A3D9F28D13F18AEF80E47B40DEFE68B60AC4421F971A09338803CB43FEF98919BCF4540F03E46F103EBB0B0BDAA0706FA8A55EBF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.....................................B.................~.........o.......o..............3..............o......o.+.......C.....o.......Rich....................PE..d.....f^..........".................`..........@............................. ............`.....................................................(...............D...............\%..0...T.......................(...........................<...@....................text............................... ..`RT_CODE............................. ..`.rdata..r...........................@..@.data...`F..........................@....pdata..D...........................@..@.didat..P............`..............@....rsrc................d..............@..@.reloc..\%.......&...j..............@..B........................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfiles.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	23894154
Entropy (8bit):	7.999991089228753
Encrypted:	true
SSDEEP:
MD5:	E3A7490BBE4B499E22DFDE4852B898BD
SHA1:	0E56C54C1063A0AFC24500CB9CE9FBF29CFB659B
SHA-256:	711DAA895530AD80E5BE32CB119CAAEF2C0CAB2D483C76044BB640A925467FE3
SHA-512:	BD670EDCC057F62A59DCFD88AB990262834858E8A64EDF739E935790389074BE411F35F91A237EBAE0111EC72D3C6D41A2E2F438ED347697BA92B446F521712A
Malicious:	false
Reputation:	unknown
Preview:	7z..'.....L.E.l.....%...........!..GO.k$....D.."it...#.....+vH.[....o.....,..S:....k..9...n{!..P....:$b......`........D.......F.9.....Vq[i:.4j..$....z..T.[`.0....@.....y."..R....>%..W3fh.lA.dT(N1O+~y@FH.SA......=...~.....E..%s.]3~V...s\|..J.......,T_....W.A.g.p..#{'.4.......&1.:fG.R..e..w...C.4E....g....2U.ge.s.....mF.=+.^@:.Gq..q$.Y...V+B#P..Z..`.e.g....1I..E..s../.@.jr).j?....). aHB.~.2.j...TEq.8....+6A.5...).y.S,.EQy.>.v.!:..T.......O....H...hC.\....o.9.f......M..Q....4...Ly!.o.........m..).....L..5L.....b~....s..G`k..&...q...=...%....{..!5.tx.N...-K.\O.j[Y...c.i.R.......F..s}7..>k...&.....eY.zo..y....N.}...eOB....%....t._9....\<..E..).......A.B...N...X.;..D4lU..?P...].ZH.Kp?._.....z..M06..cL.......'Z....=..0*U...o.._.....>..k$..d...lp.....,B....Tf.s...%M......@..D.X'd(w.QIaQJA.........Wk1..~a...IP.`.G~..e.9,....l..;g... GW."..YB...X..j..........[+:....g....^....P\..x..psP.c.......q.....$?x[.f....H...v..t.B{v..(./...c.h<D

C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfiles_printer_Win10_x64.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	351026
Entropy (8bit):	7.999424975403893
Encrypted:	true
SSDEEP:
MD5:	0A5C7693837CC08AA0BE9F046DA06581
SHA1:	626409598CA25A16E05275E68C2BD18537F2BBF7
SHA-256:	E1050B0B524DA05D0D2D03B1DB076918D334E53D46A5954CBF4EA9AC697352F8
SHA-512:	3D50D35F92FAE53AE8BCD14798583532DEFF0133CBE227D39612ED53AAA9ABF830544DA0B9117840A6C25B11801ABDA3EE3C525CFD6F38FF3AB73AC1C72E356A
Malicious:	false
Reputation:	unknown
Preview:	7z..'...5o...Z......$........g.$....&....FnP..p<......o..:.D.y.2...;N...$.....R%.$.+.y.4N.T...I..!...W.iX.u..>c.......>....hU.}V...!E.......>1...`.........-\?.&S....9...A.(1.O[kOK..\|.a.=.`XK..%..9F.S8..\|.D=.5.b.z....]....?..........SV1.Pj.W.....z....<..2..uZ.Fx..u...SD..Y$a.>.../O.'.[....Z`k..,x.9m..c........@..,...Rs...F....(\|..s.ua.I<.nC.k[..)..'..k.k..;2;-.qs.T..fY..W]u.g..+78..f.{v.h........0....'b"..-.5...f....8g.t.m$..mG:..).........q..i.......E^...rm...O..<299.]..'..oS.?l..ks.L..,...~V.q.J.y.E.K..1..F}.r... b..6.E.^.[..w.....7..K....>Oq.2...K....8.2..D..u{....Q..v.........`..\.4)......Y.&.....7...P.V.P.V.7........n.F....;...H.y.....J......._b0..........m..g.O.m-...<.......:.w.!7.4@R%..L.d..[B>-..'n.m.M.U...;Q.....5._....>p..Rt..PHw.........?v.....:T.vw.@.ZY.S.a..[...d.jm8....d..Eh....C..RJk.g_?..C.p.x..2..@.[.<.-e..N.....1..,2......._.!...G../..ht%..N.N/.tf.P.XRr.............r..X..e.iJ.S...RK!1.....H......-.]........1..

C:\Program Files (x86)\TeamViewer\TVExtractTemp\tvfilesx64.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	32230
Entropy (8bit):	7.993796473930373
Encrypted:	true
SSDEEP:
MD5:	75D8CF6A5232E09F14F3790D991163DF
SHA1:	DDDF1583DD289F2169DE98E98F650316EAE9A68F
SHA-256:	A5B3DC5B996085BA918D4DC75C1681A71120CEDEBBD44B3A0C17B2792200514E
SHA-512:	8B4DD1B63EB2DEC5B8406CFFDBA01F5DD4C0A0EF07D7D786555058DBA708FF3A261B9A3D4B7546C900657DE0064B2277CC0279FB1CCCD39949487D5AEE2D4CA3
Malicious:	false
Reputation:	unknown
Preview:	7z..'.....r".}......$..........R.. .(.....H.U......6.PXGp..F.5J..E=I..2..A/@.%....P)..H..Sp..u>=C..C...N).......(..."ZZS ....W..@[_f%...$..E!..a..B...v...L.'.`.~.b..F.._Rbc2......^.s..D@.?..8,z_S.xY...............YJ0gzd...J...jYl......DD.. .'M...C.....h~.6.....r...K?-.m..]."........5..Q5!b......7...^......s.....g2j.S.'.;.K.3'.s.=^b...)%2.'...~=...!...m>JmGS~D.......s...P..._...G...h...%..M......#.[.B...Y.N8..J,..H+O2.....d......R.Q..R.t.....qU.3i.[..z7...NcB>Tig...\K5.,.P4y....}..w.....j<..O9.....[A.-..]...L8.K..B..LT.H3.bF./.FaX...."wD..ss.N.I....7......]m,.m{.E.7b..6..R;Z..^Q....o{.+.)g.a.....C....\|.,...3...).xQ..}..D. ?........ H5..4X.r...K...X..u.H].o&..nU..E..a.T.$.....f....3...Vr/._;..Cw.`+..@&d..}..-;)..d1j q.t.S...Y%}[K....]:.sP........x.F.2NU%..<.>VE..9$_KP.....H.w.7......H...lg7.."^.`K0....8.....1........8t....F...}.i..N....i....S..^.`.g..42...:..`{.V..7...V...f..,...C.m04...I.j.d...h...D9.}.hPQ......Q.N2!..K.I..jB9.....x.q...;.....S

C:\Program Files (x86)\TeamViewer\TVExtractTemp\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	892512
Entropy (8bit):	5.422618206317548
Encrypted:	false
SSDEEP:
MD5:	1A3E1F49966DD5C97D179BDAA59C1A52
SHA1:	D352902B2A54ABB165EC56974791FF9333771D05
SHA-256:	DBB6A1A9936F0C836FBBDC1661119637DEDF40C492734E2E1A59418061047D0D
SHA-512:	581101A039BADEE4A2FC9B7B31F78FE11DF1997C13C485D79F42CC50DA2E26220811DDE4B628AE0A316AB61427C57EF65F894268AEC75DF21F5A7C838A3FAB24
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................d...........2............@.......................................@..........................................`..@...........P................................................................................................text...{c.......d.................. ..`.rdata...............h..............@..@.data...............~..............@....ndata.......P...........................rsrc...@....`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	5.282965170818026
Encrypted:	false
SSDEEP:
MD5:	5C05880E0ED65FAC3A4DFB7B6802B898
SHA1:	55EA8DAC7093123E26584A49012517818C0F586D
SHA-256:	60FA2925C589AC38BAB74713E1B0BB2A205A8C825D614B971FC3426991CD86CA
SHA-512:	5176504DE06E6F8249815F8F8472ED7C9A26003E92ECD80299DA8B611A630A1BA8179419CDF50F02B78A19CAF221D6E0AE59452B224DC55FEEF72A93CD4D147D
Malicious:	false
Reputation:	unknown
Preview:	; Copyright 2010 TeamViewer GmbH All rights reserved...[Version]..Signature="$WINDOWS NT$"..Class=Monitor..ClassGUID={4d36e96e-e325-11ce-bfc1-08002be10318}..Provider= TeamViewer GmbH..DriverVer=02/01/2017,1.02.0000..CatalogFile=TVMonitor.cat....[SourceDisksNames]..3426 = %SourceName%....[SourceDisksFiles]..TVMonitor.sys = 3426....[DestinationDirs]..DefaultDestDir = 10..MonitorFunction_Files_Driver = 12....[Manufacturer]..%MfgName% = Driver_Mfg,NTAMD64....[Driver_Mfg.NTAMD64]..%Driver_DeviceDesc%=Driver_DDI, *PNP09FF....[Driver_DDI.NT]..CopyFiles=MonitorFunction_Files_Driver....[Driver_DDI.NT.Services]..Addservice = MonitorFunction, %FLG_ADDREG_NOCLOBBER%, MonitorFunction_Service....[MonitorFunction_Service]..DisplayName = %MonitorFunction_SvcDesc%..ServiceType = %SERVICE_KERNEL_DRIVER%..StartType = %SERVICE_DEMAND_START%..ErrorControl = %SERVICE_ERROR_NORMAL%..ServiceBinary = %12%\TVMonitor.sys..LoadOrderGroup = Extended Base....[MonitorFunction_Files_Driver]..TVMonito

C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18336
Entropy (8bit):	6.275348584247018
Encrypted:	false
SSDEEP:
MD5:	B7CA6668278FBAE3FBD649285F8CCC35
SHA1:	DD5CD2FB0E6818EB56268F0D6E72D0F5AC74AEF4
SHA-256:	78318C6A8AE65FB3AFE6BA06CF1BDA69903390E250950D3BF78895CD79AFD4D8
SHA-512:	7305B979ABBEF7BEB4789261E9FC0EBDE00415BB00ECEEE2289CD1FCF91467CCC7C84ED77E7F5CD042243508B5FC8C3384EA59D6A1A17497781110FE5238103C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..S%.S%.S%.S%.s%.Z]I.P%.Z]O.Q%.Z]Y.W%.Z]P.R%.Z]N.R%.Z]K.R%.RichS%.................PE..d...)x.Y..........".................d`.......................................................................................................`..(....p.......@.......(...............!............................................... ...............................text............................... ..h.rdata..t.... ......................@..H.data... ....0......................@....pdata.......@......................@..HPAGE....z....P...................... ..`INIT....x....`...................... ....rsrc........p.......$..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5391
Entropy (8bit):	4.832043523407305
Encrypted:	false
SSDEEP:
MD5:	447FC733747DB11CD4492AE01C5652FE
SHA1:	2A70DCD391464CB8D3736322E07E966E105D396E
SHA-256:	A817B0E8A669D5ACAF2DDFBC95ACF2A1213B092B44DC896A0EE4A5301D06EBC3
SHA-512:	238099DB072AF55445D421E941944ABE8A6F52A124A26CAE84C1DD52FFFAFC4DAC5586D0C7407B461CD0DB8E771E1DBB6CA34AEE84581B24347F401410B2AFE5
Malicious:	false
Reputation:	unknown
Preview:	; ***************************************************************************..; Copyright (C) 2007 TeamViewer GmbH.. ..; ***************************************************************************......[Version].. Signature = "$Windows NT$".. CatalogFile = teamviewervpn.cat.. ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}.. Provider = %Provider%.. Class = Net.. DriverVer=11/27/2007,2.10.00.0000....[Strings].. DeviceDescription = "TeamViewer VPN Adapter".. Provider = "TeamViewer GmbH"....;----------------------------------------------------------------..; Manufacturer + Product Section (Done)..;----------------------------------------------------------------..[Manufacturer].. %Provider% = teamviewervpn,NTamd64....[teamviewervpn.NTamd64].. %DeviceDescription% = teamviewervpn.ndi, teamviewervpn....;---------------------------------------------------------------..; Driver Section (Don

C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	10645
Entropy (8bit):	7.272624114612594
Encrypted:	false
SSDEEP:
MD5:	5CFFE65F36B60BC151486C90382F1627
SHA1:	F2A66EAE89B4B19D4CAB2AC630536AF5EEEEF121
SHA-256:	AA7C09A817EB54E3CC5C342454608364A679E231824F83BA5A2D0278EDCC1851
SHA-512:	1BD48EF66F8714E7E9591043D03BD69A30881ED3D0F2463B15750A3282DF667FFB076B3A92358EECEDAE0E54485B07D702667E8FE0AF64C52BE04DB47145920B
Malicious:	false
Reputation:	unknown
Preview:	0.)....H........).0.)~...1.0...+......0.....+.....7......0...0...+.....7.....^FZ..t.K.........071228163009Z0...+.....7.....0..^0....R2.A.7.0.D.C.D.3.9.1.4.6.4.C.B.8.D.3.7.3.6.3.2.2.E.0.7.E.9.6.6.E.1.0.5.D.3.9.6.E...1..O0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...i.n.f...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........p..FL..sc".~.n.]9n0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.7.C.A.9.7.9.F.2.2.A.E.3.2.A.2.6.8.5.5.1.C.A.1.9.6.2.C.D.9.5.2.F.D.E.2.3.8.6.9...1..W0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........".2.hU...,.R..8i...L0..H0

C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35112
Entropy (8bit):	6.279693420486803
Encrypted:	false
SSDEEP:
MD5:	F5520DBB47C60EE83024B38720ABDA24
SHA1:	BC355C14A2B22712B91FF43CD4E046489A91CAE5
SHA-256:	B8E555D92440BF93E3B55A66E27CEF936477EF7528F870D3B78BD3B294A05CC0
SHA-512:	3C5BB212467D932F5EAA17A2346EF8F401A49760C9C6C89C6318A1313FCBABB1D43B1054692C01738EA6A3648CC57E06845B81BECB3069F478D5B1A7CBCB0E66
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mN... ... ... ...... ...N... ...!... ...[... ...]... ...M... ...Q... ...\... ...X... .Rich.. .........................PE..d.....`G.........."......Z..........................................................\|......................................................0...<....................t..(...........0q...............................................p..(............................text....P.......R.................. ..h.rdata.......p.......V..............@..H.data...x............`..............@....pdata...............b..............@..HINIT.................f.............. ....rsrc................n..............@..B.reloc..<............r..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TVExtractTemp\x64\tvmonitor.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	8881
Entropy (8bit):	7.27496797439638
Encrypted:	false
SSDEEP:
MD5:	1F2380A5474583DBA929F761A760546F
SHA1:	561248613C6F443D8A993900E2DBEBF3B718A660
SHA-256:	143DF27418B1EAF375BED6291765E2E77166830D6216A6BFB71A075735F05DA5
SHA-512:	4309403DF0A29C53190833AA13A6E67A4501650B77106BC62925F691DFFEDCAB184B6DF3B8BA750E0A8FD4C9B6E0919B729F5BD250413178CD7A4CE287241AED
Malicious:	false
Reputation:	unknown
Preview:	0."...*.H........".0."....1.0...+......0..\|..+.....7.....m0..i0...+.....7......i.&...E..l....N..170512092819Z0...+.....7.....0..F0....R2.9.6.0.7.A.C.D.0.3.F.6.4.A.B.F.5.2.3.9.8.B.F.3.D.E.0.4.E.8.1.9.D.1.A.0.8.C.3.4...1..K0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........)`z...J.R9........40V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.5.E.A.8.D.A.C.7.0.9.3.1.2.3.E.2.6.5.8.4.A.4.9.0.1.2.5.1.7.8.1.8.C.0.F.5.8.6.D...1..C0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........U.p..>&XJI.%....Xm0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0....+.....7......0.....O.S

C:\Program Files (x86)\TeamViewer\TeamViewer.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	DFA1EDAEE9FCC286C1AD2CD2EF600908
SHA1:	B41BAA85C234823AA6F49E4DB70FBF5BDE3DFFB7
SHA-256:	70B7612B6B9E9EB0C7FD24A20BAB06121F0E50CE6AA5DE2C46646B8739471869
SHA-512:	EE889232485D0C0871AC88E5C023D9ECDE4B5998389EE902CFF5110A874D18FED38D047598768CEC4113FE28DE30837A9979158F1B4229B0C1B88DBAB4C03DDC
Malicious:	true
Reputation:	unknown
Preview:	MZ......................@...................................p...........!..L.!This program cannot be run in DOS mode....$.......(Z..l;..l;..l;...]...;..riv.m;...$.i;..>S..O;..>S..D;...]..A;..>S...;...]..o;..6....;...R..u;...]..n;..l;..h?...]..k;...R..w:...R..?;...MH.n;...R..d9...]..W;...R..e;..l;..A?...R..8-...R..m;..l;t.m;...R..m;..Richl;..........................PE..L....&f^.................ZM.........P........pM...@..........................@......_.....@.....................................(....P...............4..x:......d9 ..-..T....................-........].@............pM.........@....................text....XM......ZM................. ..`.rdata....l..pM...l..^M.............@..@.data........0......................@....didat...............&..............@....rodata.@.... .......4..............@..@_RDATA.......0.......@..............@..@.rsrc........P.......R..............@..@.reloc..d9 ......: .................@..B................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer15_Logfile.log

Download File

Process:	C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
File Type:	ASCII text, with very long lines (812), with CRLF line terminators
Category:	modified
Size (bytes):	26249
Entropy (8bit):	5.340629791018915
Encrypted:	false
SSDEEP:
MD5:	60699558F0811BC145B8D5EDFE6315B0
SHA1:	F384192732FAEDDCDDD7C371BD468A88898222B1
SHA-256:	61AC005BA0F2B3B8F6277167C1EE7463617EA99D5B63C1DDB1177BEF54E75D15
SHA-512:	08DC9F2D9B05C63677FA59F379051286C171F811DF69E62A944EC8105E8E5418C2CC8C6BA38520239EB911775BA8780391D940E43EAC1702B61B915BE9C52D5F
Malicious:	false
Reputation:	unknown
Preview:	2024/06/10 17:28:35.559 3316 1928 0 IsWindowsServerVerifyOnce(): Is a windows server 0..2024/06/10 17:28:35.559 3316 1928 0 Logger started...2024/06/10 17:28:35.606 3316 1876 0! AsioSettings::FindExternalIP: found 0 external IPs instead of 1!..2024/06/10 17:28:35.606 3316 1876 0! AsioSettings::FindExternalIP: found 0 external IPs instead of 1!..2024/06/10 17:28:35.606 3316 1876 0 Generating new RSA private/public key pair..2024/06/10 17:28:35.655 3316 1876 0 InitializeRemoteAccessAPI..2024/06/10 17:28:35.655 3316 1876 0 QueryVPNRegKey: Subkey 'SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\Configuration' (11) has no 'MatchingDeviceID' entry. Continuing.....2024/06/10 17:28:35.655 3316 1876 0 QueryVPNRegKey: Subkey 'SYSTEM\CurrentControlSet\Control\Class\{4D36E972-E325-11CE-BFC1-08002BE10318}\Properties' (12) has no 'MatchingDeviceID' entry. Continuing.....2024/06/10 17:28:35.655 3316 1876 0 IdentityManagement: Lo

C:\Program Files (x86)\TeamViewer\TeamViewer_Desktop.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	3B2A468CD816CF7355E6765CDD98D1AD
SHA1:	7073C97CD7EDED5F1F85092D6C975080B58EBBC0
SHA-256:	B8F2D68CA22DCE6570AEDFB71FE0176876F29A053DB19338C145CBFEC58B32F9
SHA-512:	4FDCE3D189734044847E4393F9197F5A4613C4C420BCCD89671ED7A5D642672BF60F7FD06A8121FC011FEE8820674B2D564B68F235D82D9D00A09B6D9F60A251
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......M.~.............l..............#......[.......[.......l.......[.......l...)...l.......l.......SF..u...............e......................,.......Z.......;.......O...........................Rich....................PE..L....!f^......................$.....PTw......@....@.................................c....@.....................................(....0...f...........2...........N.....T...................$......8..@............@...... ...`....................text............................... ..`.orpc...f....0...................... ..`.rdata.......@......................@..@.data....>.........................@....didat..0............h..............@....rodata.@.... .......n..............@..@.rsrc....f...0...h...z..............@..@.reloc...N.......P.................@..B........................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Note.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	2BDBB7391BB20EFF464C223597DE8DF8
SHA1:	96C1705E72A410A092C171DC9B8AF46F9B99552B
SHA-256:	C4C4B8C28C23576E5DC7A3061B85A67117407669272E42CD376350ED247A834E
SHA-512:	64B6D18181C10877E06F469F85D0A244D27575B3D793C1AB06600F653CC58EB638188D6F067FA38C4AF60777CCEB122BB2D025AD0EB395B111F7615B4700DB3F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......?...{.s.{.s.{.s...p.m.s...v..s.).p.c.s.).w.Z.s.).v...s...w.a.s...r.x.s...v.U.s.{.r.".s.!I..s.s.{.s.R.s...z.(.s....z.s.{...z.s...q.z.s.Rich{.s.........PE..L.....f^..........................................@..................................B....@.....................................(.......H{...........L..........<...0...T...............................@...............L...\...`....................text............................... ..`.rdata..............................@..@.data............f..................@....didat..d....p......."..............@....rsrc...H{.......\|...$..............@..@.reloc..<...........................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_ar.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	167BADB41DEC5E511618F7DD92B71843
SHA1:	F4798E2901DFA6E397655DD69921CBEAC539CCE7
SHA-256:	37492C85452064FDFF267361C4A642E89851E9BF9C56C2A7C0AE734B96888E8D
SHA-512:	9DF8804357ACA240F328D2A3528E8E252B604E90FF011BC85F3008EE9E841B3FCFEC14D2B42EFE4820FB84056FA61396C2A7AA5CA37E08DD5BBF1E785CD9E4D3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...w3f^...........!......................................................................@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....w3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...p...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_bg.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	97811671330F434CF31F635A0FD8A7F8
SHA1:	F7BB8533E03959107DA36895F1992E7503D074CB
SHA-256:	137D78509647B17E2CBFC844048EC73A4A455ED15B869784D0E8D05CFC3EFB49
SHA-512:	D22A33B0A5A31A5563610B22D0560DF9369D9A09C9F2AA3B0992EF429525137B55AAA814877AD0F4789B445B5506FA678EA4358DDAE7EEC1FE1992F0FECA9950
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........\|...........................................................@.......................................... ...y...........~...............................................................................................rdata..p...........................@..@.rsrc....y... ...z..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..PF...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_cs.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	524FAC87CC47DD324952E5D7E09CFBA0
SHA1:	DDB692A9D80ADCCEA3E93A40A2B6CD60F475DAD7
SHA-256:	04ED2D65375871F10BDAA4BBF691D79E39A9649074DAF8C67D836F6A74750618
SHA-512:	65510E259874A7D2009DBE0E5AFD3EAD4253AAD7D1564D8F6F1BD518E5170207E7DC66908CB37DD77D2A9FE45AFCD944EFB6FAB59AC8F9FED6B33E9DBF6B2D06
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...n3f^...........!.........................................................@......7.....@.......................................... ..P............................................................................................................rdata..p...........................@..@.rsrc...P.... ......................@..@....n3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_da.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	664032E52DAE0F05C80F3946E8470DED
SHA1:	48D6200B262DD25321A2EEA77B4E94EBF58E3E0D
SHA-256:	A747C3C47A64C3864634A4F269E5062C8A38EE22987BCD21DA6AB6D744DA9962
SHA-512:	D2000CDC481F10CD183E4F764265068B212EE6D897D7819D31FC1894C61182A717ED5C09D0788C3C2D46C2B3D2AA2D74E4C63116099A080174A43586F9F2282A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...33f^...........!......................................................... ............@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....33f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_de.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	6F433ED2A921D8DB9416E5B2A87E4F66
SHA1:	8AF34B426FD656097842F7D0920CC8AA4BBD0517
SHA-256:	1A54411EFB23A94DE49AB57C6DA74CA7459C733571C85796D6F468E8B942CB35
SHA-512:	AF8408C567E9D1C5D70CA5498497707D7697034A52494B3778CBEFF5C0704C3AE3FF7FD024E5B4762B4C56E4A447FD284AF55D4A672A1D34DCC95DA124EB56F3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!................................................................`\|....@.......................................... ..P............................................................................................................rdata..p...........................@..@.rsrc...P.... ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...j...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_el.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	AFF078431E8360F25B7725093BFE42A3
SHA1:	EF5F67EA730B15AB53DC5F57BB67E0C4F1039B83
SHA-256:	5633A8D2C7A4AD487636CAD6D8F53CFEC9D070825AFE3BFEEB74F8DAA1E26DD9
SHA-512:	94EBAA891340FD7FBD9726A4B86621B93C00B3400913107F08430E71EE9B054E91CF8FD259C70AD41280F2312A25ADAE2464F7D50FEC0DC1A806C5334DB22245
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........................................................0.......;....@.......................................... ..x............................................................................................................rdata..p...........................@..@.rsrc...x.... ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_en.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	CABD7ADDF8623E1B9216F1F22C202A6F
SHA1:	587906217A8119C54FB39F041FCC81FE835F6BC4
SHA-256:	3E5E4ADEDF07E8069E34C33FE2CAF0721D01A2DE8CA605EAB1E7551A0BE1C6FF
SHA-512:	D931A4C1CA5092A37A48DB3E88E263A2124C233E955E53288DE743DC1B6080FB6516BFBD2662A843D1B9977C8D853B7AAE4A9EF788FCC5501173A8A309E480F9
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.................................................................%....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_es.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	615F901221BEB951E4979E7065605837
SHA1:	0F9E907B28BB0417003F996948B4F90BA73F3A99
SHA-256:	175CB99157B5F53293C02CDD84395952D96C9AD6B3AA964782AE5520753342A5
SHA-512:	44A466596A4AB8729D0B57F87F6B73C3094B81B86F02734B0E7A7FEFC5C3A9DA060E609987A6C80A8FB45F9AB6465197BFE8D478F33DF94F67EAAC510F9E87A4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...D3f^...........!.................................................................'....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....D3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...`...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_fi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	538533B20B29FF4CB5173E8036F20900
SHA1:	6DEA3B561EE7C71FED08DB4F25C548B34EDDC2D8
SHA-256:	B437CDCA33067C756A43553D5992C602792DDE956CC97E8856303C1BCE906F64
SHA-512:	001874ADB60ABECCF8DD5C466CC033C257573D60913748966B3DDCD3B8075078854A932352914931BC5C8DDCC7981FFE31C59D09B567CF4F9C4ADEF6F917E313
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....4f^...........!.........................................................0......x6....@.......................................... ..8............................................................................................................rdata..p...........................@..@.rsrc...8.... ......................@..@.....4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_fr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	D778D0CE59B9A39EF6073AA6EF66C858
SHA1:	FFF2331D827270FF0B6FC027CC51C6B7934134FA
SHA-256:	229F50C0AFFDCD133BB2076B18CDA1C02094AB084CEDD20BDD69E48D2BB7AB7A
SHA-512:	A101EECBF7EB58B97D790BF133CF753BD5581AFD5F186806C2EF4216D484756E5B7FA2166FEE97556C21A37C0B709BAB0DF157B53B916CF5CC677E771E3C2C35
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L..."3f^...........!................................................................wi....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@...."3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_he.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	EC8A38B3FD8C06EAEE82349202985BFB
SHA1:	EA708D27313541B4E49897E6629B3EF561536A40
SHA-256:	EFD255D8D2794232FC71A5CDB296172B7898523001D3AC6F9AE79DE793363070
SHA-512:	95CAA516E39F149BBDC125935192299DC75BF958386B1513E9C2BFBC263FB8B1EFA62D1493A235A169953FEF231FBF50991AA3100F696C65C134B244DE3D7C36
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........................................................0............@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_hr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	FCFEF1E4825BE7184C6CC29943D76D8F
SHA1:	1AC6E010A40A24EB2F29FA00108F2E9A594C4507
SHA-256:	C48B6E2A9E200B68E52317E902E9BB57D88FD43402FB836DE91DEB4C802768D4
SHA-512:	AAF1C36F2ABFBF036E2D4C69FEBE60510B79FD580C255767A47467451B2D4F4B10DAC98AB380DB883D23E8C6BF0CD4DC17DD37536490C3090A1952AF269DEFEE
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........P...............................................p............@.......................................... ...M...........R...............................................................................................rdata..p...........................@..@.rsrc....M... ...N..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..8....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_hu.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	1F50C2C7670D3CDA50C3A364F9ED2845
SHA1:	A6E51D2E1D24A614A02B6ED5B5242076A4039E71
SHA-256:	A903CA331A20930C00AF86AA4A0FD999017CFD218C58DB3B91B7D99FEDB5CF5F
SHA-512:	8098583489F9E6F44D50DA80E2067D70F0952C7B6386B2D68FBBBCA09469BBA9CEF03411E5F290C002E522FFD1C1D96F3E2D4C2D79B0BA93D7999F181CEEBA63
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........~.......................................................@....@.......................................... ...{...........................................................................................................rdata..p...........................@..@.rsrc....{... ...\|..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..(H...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_id.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	9961D60FF798FA926381C75799AB65C2
SHA1:	67D979BBAB1D6FF1F943721C5B017662DFFE7524
SHA-256:	B38B4FAA87D047C142AA907E484B3E37AB041A7F65D2F45E2AE71D540CFBDAC3
SHA-512:	3D42C3FC94964216FF92784E7D895B4F50FC3F3F44C2031226E7B3F093F6E1F98D1C7A32EB817749998BA2001F27EF4470950D552F638B619F3CF6B07084B926
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!........."...............................................@.......w....@.......................................... ..0............$...............................................................................................rdata..p...........................@..@.rsrc...0.... ... ..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_it.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	281510B470F12C36DAA9872443BE98EB
SHA1:	91C9B77BA9B5298B9CCC5B2114153BD97CE69E9D
SHA-256:	EB24146A9FE319310370A520C363450069FE3331931CF1D5A1FEC41570768FB4
SHA-512:	046D4696A7C08CC036B7A7ECE9D269BFCDE8832C1101E5AAA0529EBCB61AF126815105F71E254A00182D9DFF8C49C1D5B504827C3F86C6C94F9B2F19AC2AFD12
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...+3f^...........!.................................................................-....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....+3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..._...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_ja.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	72CD78EBB2F7401E455627E3B8A18582
SHA1:	A54F9B3C215314793F9EEDBE696AAE34484F20C6
SHA-256:	F25C1489BD2F5AE2F3A1A678C829F283EF20EC2AFEE33FAEFB9BCCD0FCE84E95
SHA-512:	3773EE1F1A5E2B4B6E1959664ED567A66D8AD36EC1DD853D4B3E541576459654F2419D4529FEB60AB26D36D536B5FD154B33B535F0C367D4C63DB08B9A6AB11A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...f3f^...........!......................................................... ............@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....f3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_ko.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	2A0DCF7A95802524F33E6F7B15B48F0A
SHA1:	5B64ACABDED58148A397D3EDC82F8D5EE3183601
SHA-256:	7EF5EB8B86A8060D5539971DB7D198E747C6DD55415A08F4133D406C170F6797
SHA-512:	304198454EAC9FEF7246BA8A14B48CCDFA1BE34D22B2A4AB5580271DE3572ABA97435F3DA499F8E0B2476B88A4885DEB741092180346DA1AEBBB88C5E59D88CD
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...U3f^...........!................................................................~.....@.......................................... ..0............................................................................................................rdata..p...........................@..@.rsrc...0.... ......................@..@....U3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_lt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	7C154C044B0E8A67AEE9FFA721A3DFDE
SHA1:	D5B14DFEE963A5D9358527A59696647291F2DAF5
SHA-256:	67307BE5A7A35C0BBBF7058A5BDC5022A6664BE8E7AD4E4ED5F274F2A723C364
SHA-512:	240583BA0235C0C2E13D72C9AA4D4C8D0BCCE65096C554BABD390B8E7A7F2F3ADDA7D7EFCE68B6861D6BBAA96E7FF463AC0F968D654111470E7D9933F375B71C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........t......................................................M\|....@.......................................... ..Pq...........v...............................................................................................rdata..p...........................@..@.rsrc...Pq... ...r..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...=...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_nl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	33F20D0326410AF0DAA3EF26FD8DFC01
SHA1:	32F36F0305983A13E40B251DF3207BA535344490
SHA-256:	C45AAD18F79FADFAEC4A8396CCF42320642DE0709BFABD1C51C5D3D629B6E6AD
SHA-512:	3EF05E67F8EBCBBDBCA9CFEBD9F9640CC152FE6948A60CF7399B8E6B1DFB513F09721AE86FFF1DFC14CFB5BA77AF73BE2A2BCA86C30B5960A5E3FB11FE648AD3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...;3f^...........!.........l............................................................@.......................................... ...i...........n...............................................................................................rdata..p...........................@..@.rsrc....i... ...j..................@..@....;3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...5...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_no.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	6394396382A2EA3557B462610024141B
SHA1:	CE1B4DF9CB26CACABB384EAD3CCB5C934E8F8B62
SHA-256:	9612DA4D29048AC283DE67D98E03AD2B5D67D178C1BB3BBB517F393E14D5F9B8
SHA-512:	460680FA6926405648653613B0B1E0C0922B2475ACBB63BE3E5B77BD5605594A8DBAB105953B3B7DDB78F0176F0F044496F80B7D20869214722E87E964B8E32B
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....4f^...........!......................................................... ......-q....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_pl.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	0D71B70B206BFED2F637B486BC1218F6
SHA1:	DFA1A8C8F3143F2F06FFCC88BA2B0DA479593AEE
SHA-256:	F51ED8CF0EB16F807FE45F078D1A226DE4DE9E9BC5ABD6C0C003A8A21EB273DA
SHA-512:	BDF0D6A3B30883DF47FCE11190CDA948C183F14D4DCD32E4479E1EDEA4585CEA157E82E14D41C81D0F7DBAE8745876FCDE60BA7ECD9E6061CA3D6B4F48226DCC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........x......................................................d3....@.......................................... ...t...........z...............................................................................................rdata..p...........................@..@.rsrc....t... ...v..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..PA...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_pt.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	49255B1FE7F3D612217F7DD3B02308BA
SHA1:	1AB10073E923BF8A37F920D6AF040F3647654954
SHA-256:	A945A16BF8A5C3E8D0C14F61FABC4241E94F6921636251FF93A0E47B758D6FC4
SHA-512:	0F1E5203E830E7C0FC85DB12B701ED02E00ACC2F143B5176F421A35398432BEE889F43E84E11D9C8C8E68BE2D59A191142AC3CB3689605CB18761805A3B9456D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...L3f^...........!.........X...........................................................@.......................................... .. U...........Z...............................................................................................rdata..p...........................@..@.rsrc... U... ...V..................@..@....L3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...!...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_ro.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	035A2F432D8032EAF2962EDD6F895056
SHA1:	A277D64A63F6149164C1E37865645F4A03538C83
SHA-256:	75AFDED007062486A155C82E5E8AFAEDE4AA685274B37BAB872257E463FFAE7B
SHA-512:	B10726278E793A86D33F465738F2B0C201762C028965D66BA0E5220956C50B63BBFD551C2020038DD1E27E1C808B76A5E3B80B9744E4B6EE8365FA299D8F26EA
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!................................................................q.....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..h....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_ru.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	CEF0CA0C674673116BCCA878CDAE250C
SHA1:	19B3FDB53935830DE0741522B8650A839CA2B34A
SHA-256:	873D3B7674BF20AE11FF3510311140919F65C25068F72B043F69291A45F2404A
SHA-512:	764D97F493CFB3B07D5DB74A375E7CB0579B7934D5A735802C31F3C3B6FA5C2F301996CBD3E7995240121200B7843459D9123541D5EEF499B015972644128EE4
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...]3f^...........!.........f......................................................o.....@.......................................... ...b...........h...............................................................................................rdata..p...........................@..@.rsrc....b... ...d..................@..@....]3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..P/...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_sk.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	5676AA55DB5F4D15C2C2BD94669AD736
SHA1:	A35BD3FD21D3249C9DC1D0E8EF317680A5F5BF07
SHA-256:	30DB391D6C5C62DC04D2B91DB56484D66AC32EA86BAB002ADF567B23B9347CA6
SHA-512:	24A17602CF67AEBE278C15D77335FE1BF3B701FFB34900D3184892147BBB85E1331B35146D110E2142096BB4BDB00256B80D7198BD2F30F198AA21FAD1F7B313
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........B...............................................`............@.......................................... ..p>...........D...............................................................................................rdata..p...........................@..@.rsrc...p>... ...@..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_sr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	67AEB735FAFBE7A749BD0641382360F2
SHA1:	DA0B0D3CDB8EA0D41DE63FA19F3F2F87EC5A2FD3
SHA-256:	BB8B2C7136AA6CE56DEEED473F8B2F76E5FA087259D54832270AC96E940DD39F
SHA-512:	6249112D0CFF1239CEC851F0E5B97128FAF260F10994307FAF4B5B8DBBEAE73A64F71AA3AF0C202E2F173CE55B1126C22987F4EA72F9832DB641692A92AB5C54
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........F...............................................p......cc....@.......................................... ..@C...........H...............................................................................................rdata..p...........................@..@.rsrc...@C... ...D..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_sv.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	765CF4D5CFC3AC48247D9748654A9403
SHA1:	E1033A93B648CFA8BF518BFA723D1D4ED2425830
SHA-256:	DEAC9381BB13821725CA6AAE8926C43887C02DC560B107436BFDEE747C5AC487
SHA-512:	E403429F14328DE6C92C2836048F40B0F9345D374E9E835CCAA3A93204C9A2B7A5E403EA6C03622D953BC8CE1FE61B4DF589EEB0317E22119BF6A3620338C9D0
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L...&4f^...........!......................................................... .......}....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@....&4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..@....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_th.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	A8860A177599AA4F0E0B399751A0C630
SHA1:	8EF8A1414702BB3C2E592339624585F75C66D77D
SHA-256:	816886CBBDCF7FD501BCD989D54BD7D4991CA6791DB0C1758FC928DA1A351780
SHA-512:	E63074FE7DA0CC30A09640F81C174946B4FD4800DF9469DF060252C0987594B7890C71553A75C691522A42EBCA1DCEDDACA7CDE39237DCD730C94602EB134C7D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.................................................................z....@.......................................... ...............................................................................................................rdata..p...........................@..@.rsrc........ ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..(....rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_tr.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	5189E86A5F7D33281B2AFD441A38F42D
SHA1:	958D5150CABF49EA9E83F49859A079D4D07BAA3A
SHA-256:	4D42BAFE63A578ECF17FB579A9DF84C5892C6A0F0F2E8E6C06E9AC1D4EF80A38
SHA-512:	1C14BA4E939C4498665319145BC55705C3CE10E5C22A67EF67E5ACEF4CD73912BC456F91AC16DC57043CF2DE416E74307BAA3C36AD15A714706804264B271836
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........................................................@......l.....@.......................................... ..x............ ...............................................................................................rdata..p...........................@..@.rsrc...x.... ......................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_uk.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	914FF2A3F9183AD59B2B95EA811186B9
SHA1:	D753486E1B74FAD5DD9E4E13C53831F972323888
SHA-256:	B52FB3C0D6DF10A7E1ACE76E60E25CD8050A0493F725C63CFAF686B1132C6725
SHA-512:	22E7DA3BC5B22AF2531D2AFBD4197C01000D41B3AE2A16278EBB92657DD94A2151D3EEE0A9A5CDFE802081E6375770561866C7A728745A4703576F8516688F0A
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........b......................................................%.....@.......................................... ...^...........d...............................................................................................rdata..p...........................@..@.rsrc....^... ...`..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S..h+...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_vi.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	9CB72E2BFD2530E5C2743388CB8D82FD
SHA1:	21C2CCCB40C6D0232741A5E0EACBF3A65E91884F
SHA-256:	43CABAE3789F6FB354B508A9400D95A7E8A04AE3775E889A739642D2BF2717FC
SHA-512:	85D39BF60506115B05C341E28D5F4208EAA492C618C613920E1C2809A344EC5DA50FA540D94749F4A03FA5ECF943163AA78A2FFA5EB4BD99AD8DA32519D1EC13
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....4f^...........!.................................................................q....@.......................................... ..0............................................................................................................rdata..p...........................@..@.rsrc...0.... ......................@..@.....4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S...Z...rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_zhCN.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	1DF7E62AB680E71E5107BF54850F3AB1
SHA1:	0F32F0C631065E9115E9A76B11D94DDEC14276B2
SHA-256:	B9DA21BC42F11EE2E1EC03B540E7B9B89E3542D1CCC1FEA86A430C5B424D7E3B
SHA-512:	5F5A63B8778764AB5C5A51B7ABACFB8A86F0214C50522906F77F964DCA13A21965B3A4402F2A67FF63B5D6026BB4E0EDFF21A8479265268161C5F0E6684EA804
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....3f^...........!.........(...............................................P.......,....@.......................................... ...%...........*...............................................................................................rdata..p...........................@..@.rsrc....%... ...&..................@..@.....3f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Resource_zhTW.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	89D8FFEB80328DCD20B71F7559E1CE93
SHA1:	CAFB42F45C0FF5C7FDE8C7FA2838BD452767975B
SHA-256:	BFF902C1CD97E62D5513E354829618E667F199F3392B964861C06383C6E1FACA
SHA-512:	785FB160DDE16088F30464DE1BDCA110C1C78A6C913D66F644A43757F7ED9008918D5E8BA6ECAFC3664B1A713ECF2AA9CD88E489A7695EE432F104E097EDDA80
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L....4f^...........!.........,...............................................P......L.....@.......................................... ..H)...........................................................................................................rdata..p...........................@..@.rsrc...H)... ...*..................@..@.....4f^........T........................rdata......T....rdata$zzzdbg.... ...3...rsrc$01.....S.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E61BE4384327DF6AC8087803A7904BFD
SHA1:	C7E98A3C67B554F3F6FDC30DC1603B14339CE590
SHA-256:	72B4424085E7AF27760328539F651515F8859D5BA3DA68DAD06FDA61C688B5E7
SHA-512:	2BA4F4039B4D280B3EB72A2E904B47D0BA2E8E9BEF7E6DD351BD60DADC2A2E7AB9F44275ADC64E2B1A1F1BC316F0AA90FFC057F05A11D5D455F9A6AB80936B8F
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................P...........!..L.!This program cannot be run in DOS mode....$.......CPN8.1 k.1 k.1 kbW%j.1 k...k.1 kUY#j.1 kUY$j"1 kbW#j.1 kUY%j.1 kbW$j!1 kbW!j.1 k]..k*1 k.1 ky1 kbW&j.1 k.X%jb1 k.X%j.1 k.X$j\|1 k.1!k.3 k.X%j.1 k.X$j.1 k.X)jY4 k.X.k.1 k.1.k.1 k.X"j.1 kRich.1 k................PE..L...."f^......................7......9.......0....@.................................V.....@.....................................(.......`............f...........C...j..T...................4k......P..@............0...............................text............................... ..`.rdata... ..0.... .................@..@.data..............................@....didat.. ...........\|..............@....rsrc...`...........................@..@.reloc...C.......D..."..............@..B................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\TeamViewer_StaticRes.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E7E8598F0B04C986B187096AE0037425
SHA1:	51F828177BC94E1A1381AD3D55E45CC4EA0A4E35
SHA-256:	97ECEDA5246BA241C23C24AC0B8409576AB4A4763976CF302460FC9458C6FA1A
SHA-512:	47267E452F00A8996656F7D2CA75363233D2BA6B086D1FE3A5DFAC2065694AC47D76B1EEB317116410B5A61155EE645A36A9001BAC6AA43146D9032ACB373839
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......9.\|.}...}...}.....\|...}..{......\|...Rich}...........PE..L.....f^...........!.........&...............................................P......`....@.......................................... ..0#...........(...............................................................................................rdata..p...........................@..@.rsrc...0#... ...$..................@..@......f^........T........................rdata......T....rdata$zzzdbg.... ...+...rsrc$01.....K.......rsrc$02............................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\outlook\ManagedAggregator.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	6ECD6276A4BE15DD67A79C0AF0B8BECF
SHA1:	37CADD348C7B573E34DDBB94C653CFB7D45B7195
SHA-256:	51895AC6DD35344271207C5BE06BF1F7BC359CF99C5340014359CD26CD980EB5
SHA-512:	2E4DDFEA288664E39EA87B35771B214FE1F2338D8FF128E10FD3A42A382D5ECBD1DFEB7BCE6D4257C1DFD88B12B08D398D6FADF7DE382DBEF6AF6EA8D85E5735
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2f^.........." ..0..............,... ...@....... ...............................U....@..................................+..O....@.......................`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ..0...........................................................0..b.......~.....~......(.....(......o.......(.......o.....0.~....(....,..(....&.~....(....,..(....&.(....&...........%1.0......(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......`...#Blob...........G..........3..................................................-...........................0.......f...\|.f...].f.....f.....f.....f.....f...7.f.........B.....

C:\Program Files (x86)\TeamViewer\outlook\TeamViewerMeetingAddIn.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	55B43A060098C3DF4C42E5D66C4CE307
SHA1:	321DB33F085121674CBE882432CC61C77B82B696
SHA-256:	7E36FE802523BE4750EC3EEB420FA5A67233508A41737BB4B656CB01A96EDFF7
SHA-512:	00D4AF7013BDB13E5491CC1A8A432A8076333B2ECF85220715E762AF2B72FF3B16C9737B48F9C114E52D013CF31EB357CAB654BB9D77BC736412E9731F9F55AC
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....2f^...........!.....0...........N... ...`....@.. ...............................[....@..................................M..W.......l............:.......`....................................................... ............... ..H............text........ ...0.................. ..`.reloc.......`.......2..............@..B.rsrc...l............4..............@..@.................M......H............d..........x...([...........................................0..s........(*.....s....}......}......{....{....o....(+...(.....{....{....(=...:}... X.dD(q...(......{....o....}.....{.....{....o....o....o......o........o.... ..dD(q...~,...o-......(........o.......(.... ..dD(q...(....... 5.dD(q...o......o.....o....,$.o......o/...-.....o....(....o....+..o....-....o.....o....(+...,....o.....o........o....u......9<.....o....90....o....o.....Y..-..o.....+?.o....o.....o....

C:\Program Files (x86)\TeamViewer\outlook\TeamViewerMeetingAddinShim.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	CF797B1ADCEB2BAF6172506D9C845043
SHA1:	091F44ABEE5FDA49FE18EA226945D9D9178921F5
SHA-256:	B3F2ACAE6BA9EF2C46308E2B43F4C57C49F32BCAFB6E40DDBF3AFE88F4E5859D
SHA-512:	241C70F27F6303D59598C877F5D0F2B5358E1520016C727A7000C4C6DBA051CBC0D14D2EB3C5BF85862B05EB9987818F06520760F5259C77B54337E56B3F3647
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.........&..H..H..H...K..H...M.f.H..L...H..K...H..M..H...L...H...I..H......H..I...H.y.M..H.y.L..H.y.H..H.y...H.....H.y.J..H.Rich.H.................PE..L....2f^...........!.....$..........Pn.......@............................................@........................................................................p...T..............................@............@...............................text...0".......$.................. ..`.rdata..vz...@...\|...(..............@..@.data...............................@....rsrc...............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\outlook\TeamViewerMeetingAddinShim64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	B6682E2157C0B3E0EC25270875703E4B
SHA1:	DC029C58FC73689BAE7EF8FF05CDCF5C5958D0DA
SHA-256:	DCD932405A77AB199D8B053C7B61A4047913D723F46BEF82FFF984F85D883C45
SHA-512:	D3E45CDBBCBE85C7608DC5D546B086A215DC182FDEBBC3F77E05FFCD743D7A866236BFC46909F80C550B5DD69D09F3D37D912B95F96AA7CF096F17CAA662A4B3
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$.......py.4...4...4...Q~..1...Q~.....fp..;...fp..<...fp......Q~..9...Q~..8...*J..7...4...L...q..0...q..5...q..5...qc.5...4...5...q..5...Rich4...................PE..d....2f^.........." .....8..........xx..............................................'.....`.................................................<........p.......P.......:..................T............................................P..h............................text....7.......8.................. ..`.rdata..F....P.......<..............@..@.data....$... ......................@....pdata.......P......................@..@.rsrc........p.......(..............@..@.reloc...............2..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\rolloutfile.tv13

Download File

Process:	C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	93
Entropy (8bit):	5.227436436032325
Encrypted:	false
SSDEEP:
MD5:	136297F625360C6D45536082F65F87AA
SHA1:	8218AB775883FA53427A02A2D0DB2FEEC500D9B2
SHA-256:	45806C694A0154C01072C419AA37907098722C2CF3AF8746A76A8B175FCEDEBB
SHA-512:	9D79B36362C9FC5D9272E42323BA641AFAAB0BF261088723162214B911C50E8B37D7FE9322ED46AB6773FA2237582694239C14D22BA2239715DCEC4A64784CDB
Malicious:	false
Reputation:	unknown
Preview:	295016706,{4cfcbc6b-621b-448f-a011-5be8a7ba47cb},16CY/FXuDKpEGRXksPw3p4/7AdrBEXNkzTxDJahdbJw=

C:\Program Files (x86)\TeamViewer\teamviewer15.otf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E8FDF1CFD4547B86CA2C2296349ACB54
SHA1:	692A2BD8CCE1C4AC62F7CD505907AA8E21AB3B69
SHA-256:	26061147867A2C3267378A97F3897C0E3187A81B987FE8FBA570A37E1305D50B
SHA-512:	8E7F26D7F3936411446A3F2D48EA7429CFA72F229DC85C4E441F7CD6B1F91EBC90A8784854784E0F42D7E0CF3B74D9B510118E37921F37190E160B6392192634
Malicious:	false
Reputation:	unknown
Preview:	OTTO.......0CFF ......(...(FFTM{..6...x....GDEF.'.D...P...&OS/2..... ...`cmapqxM.........head.iO........6hhea.Y.5.......$hmtxP'.`.......xmaxp..P.........name..=.........post...2....... ........8..._.<..........W.......z.............................Z...........................P................................1..............................PfEd...7.w. .8.Z................. . ...................6...........k...........................................................I.........4.............Q...........x.........0...................................../.C.r.e.a.t.e.d. .b.y. .T.e.a.m.V.i.e.w.e.r. .G.m.b.H..Created by TeamViewer GmbH..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15..M.e.d.i.u.m..Medium..T.e.a.m.V.i.e.w.e.r.1.5. .:. .2.7.-.9.-.2.0.1.9..TeamViewer15 : 27-9-2019..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15..V.e.r.s.i.o.n. .0.1.5...1.0. ..Version 015.10 ..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15....................\|...........`...........8.T.V.a.e.i.m.r.w.....7.A.V.a.e.i.m.r.w..................

C:\Program Files (x86)\TeamViewer\tv_w32.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	FB9E6CC8ED7E2390DE074D896D890D02
SHA1:	DFCEC4766BD71B55F5A725F02840203DF9D0D972
SHA-256:	2286A1E1F1F18872C9366F2D19A9ED3421EAD0E9CD09A92365FD3A98CBDE0953
SHA-512:	C08561D7806815D1B4E196ECA2158B780450CEA354E01CE77C2003612C22142C07B01A8EDF4F1C9410384A18AABABA536FB259BE617D8B3E9FF1C656F341A1BB
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........0.EQ..EQ..EQ.. 7..OQ.. 7...Q...9..YQ...9..JQ...9..WQ.. 7..QQ.. 7..HQ..EQ...Q...8..IQ...8..DQ...8A.DQ...8..DQ..RichEQ..................PE..L...7.f^...........!................`...............................................U.....@A........................P...t............`...............N.......p..<8......T...............................@............................................text...e........................... ..`.rdata...P.......R..................@..@.data....$... ......................@....shared.$....P......................@....rsrc........`......................@..@.reloc..<8...p...:..................@..B........................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\tv_w32.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E1506CA998F9DF296D8876E52C67524C
SHA1:	FC6D4B71D0CB55C2D92939BDADD0135101B8E779
SHA-256:	8D47AFF2E8C53C5E414148706CF9629A8E711D199D404611E7255F26641FCFE4
SHA-512:	5CC208310363340F99863CDA2A24D76371264D53E8352655D403989EB763F1BBF3BF32F3317C68A8CDF09162264690A77C2DA27CF16199B92651F8FB4DA97844
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............vv..vv..vv...u..vv...s.Svv...u..vv...r..vv...r..vv...s.mvv...w..vv.~.s..vv..vw..wv......vv..vv..vv.~....vv.~....vv..v..vv.~.t..vv.Rich.vv.........PE..L.....f^.....................\.......Y............@.......................... .......>....@.................................(...(....P.......................`..X...`s..T....................s.......J..@...............@......@....................text....~.......................... ..`.rdata..\...........................@..@.data...<........f..................@....didat..4....@......................@....rsrc........P......................@..@.reloc..X....`......................@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\tv_x64.dll (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	6FC3F183F6EDB80173AF596968E411DB
SHA1:	45E15D364EBC549AA520A9E18A1C1D2A6CFE948A
SHA-256:	5AC6FFB4E31E6002A9C4AE2944C8A9E5EF9AC55CCF84BADFFDB9DD58AF006444
SHA-512:	924AE7A504F78248E5F7B94FF2FB104A25C09A4ADC20E1B297D8F0186842CA8D070E51BF8C9396758CEB19109A42667253CBF630EBC4D25E3CF6DC3343B02C4D
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......s8$.7YJ.7YJ.7YJ.R?I.1YJ.R?O..YJ.e1O.*YJ.e1N.9YJ.e1I.?YJ.R?N.;YJ.R?K.:YJ.7YK..YJ..0B.;YJ..0J.6YJ..0..6YJ..0H.6YJ.Rich7YJ.........................PE..d.....f^.........." ................P........................................p......u.....`A............................................P............P..........tU...........`.. .......T...........................P................................................text............................... ..`.rdata..............................@..@.data...(1..........................@....pdata..tU.......V..................@..@.shared.H....@......................@....rsrc........P......................@..@.reloc.. ....`......................@..B........................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\tv_x64.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	375704CC129FC32235A1A1318042504C
SHA1:	A15E218917747840EF9332B215F9B7183139857D
SHA-256:	2CCC9F6D657FFA5DF8AC5734A0DA82CC6CB7302B7141909D2C1A1A5A148FE135
SHA-512:	93A07AE4E47626F48E8BC6F3A3D9F28D13F18AEF80E47B40DEFE68B60AC4421F971A09338803CB43FEF98919BCF4540F03E46F103EBB0B0BDAA0706FA8A55EBF
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.....................................B.................~.........o.......o..............3..............o......o.+.......C.....o.......Rich....................PE..d.....f^..........".................`..........@............................. ............`.....................................................(...............D...............\%..0...T.......................(...........................<...@....................text............................... ..`RT_CODE............................. ..`.rdata..r...........................@..@.data...`F..........................@....pdata..D...........................@..@.didat..P............`..............@....rsrc................d..............@..@.reloc..\%.......&...j..............@..B........................................................................................................................

C:\Program Files (x86)\TeamViewer\uninstall.exe (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	1A3E1F49966DD5C97D179BDAA59C1A52
SHA1:	D352902B2A54ABB165EC56974791FF9333771D05
SHA-256:	DBB6A1A9936F0C836FBBDC1661119637DEDF40C492734E2E1A59418061047D0D
SHA-512:	581101A039BADEE4A2FC9B7B31F78FE11DF1997C13C485D79F42CC50DA2E26220811DDE4B628AE0A316AB61427C57EF65F894268AEC75DF21F5A7C838A3FAB24
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................d...........2............@.......................................@..........................................`..@...........P................................................................................................text...{c.......d.................. ..`.rdata...............h..............@..@.data...............~..............@....ndata.......P...........................rsrc...@....`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\x64\TVMonitor.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	1F2380A5474583DBA929F761A760546F
SHA1:	561248613C6F443D8A993900E2DBEBF3B718A660
SHA-256:	143DF27418B1EAF375BED6291765E2E77166830D6216A6BFB71A075735F05DA5
SHA-512:	4309403DF0A29C53190833AA13A6E67A4501650B77106BC62925F691DFFEDCAB184B6DF3B8BA750E0A8FD4C9B6E0919B729F5BD250413178CD7A4CE287241AED
Malicious:	false
Reputation:	unknown
Preview:	0."...*.H........".0."....1.0...+......0..\|..+.....7.....m0..i0...+.....7......i.&...E..l....N..170512092819Z0...+.....7.....0..F0....R2.9.6.0.7.A.C.D.0.3.F.6.4.A.B.F.5.2.3.9.8.B.F.3.D.E.0.4.E.8.1.9.D.1.A.0.8.C.3.4...1..K0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........)`z...J.R9........40V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.5.E.A.8.D.A.C.7.0.9.3.1.2.3.E.2.6.5.8.4.A.4.9.0.1.2.5.1.7.8.1.8.C.0.F.5.8.6.D...1..C0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........U.p..>&XJI.%....Xm0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0....+.....7......0.....O.S

C:\Program Files (x86)\TeamViewer\x64\TVMonitor.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	5C05880E0ED65FAC3A4DFB7B6802B898
SHA1:	55EA8DAC7093123E26584A49012517818C0F586D
SHA-256:	60FA2925C589AC38BAB74713E1B0BB2A205A8C825D614B971FC3426991CD86CA
SHA-512:	5176504DE06E6F8249815F8F8472ED7C9A26003E92ECD80299DA8B611A630A1BA8179419CDF50F02B78A19CAF221D6E0AE59452B224DC55FEEF72A93CD4D147D
Malicious:	false
Reputation:	unknown
Preview:	; Copyright 2010 TeamViewer GmbH All rights reserved...[Version]..Signature="$WINDOWS NT$"..Class=Monitor..ClassGUID={4d36e96e-e325-11ce-bfc1-08002be10318}..Provider= TeamViewer GmbH..DriverVer=02/01/2017,1.02.0000..CatalogFile=TVMonitor.cat....[SourceDisksNames]..3426 = %SourceName%....[SourceDisksFiles]..TVMonitor.sys = 3426....[DestinationDirs]..DefaultDestDir = 10..MonitorFunction_Files_Driver = 12....[Manufacturer]..%MfgName% = Driver_Mfg,NTAMD64....[Driver_Mfg.NTAMD64]..%Driver_DeviceDesc%=Driver_DDI, *PNP09FF....[Driver_DDI.NT]..CopyFiles=MonitorFunction_Files_Driver....[Driver_DDI.NT.Services]..Addservice = MonitorFunction, %FLG_ADDREG_NOCLOBBER%, MonitorFunction_Service....[MonitorFunction_Service]..DisplayName = %MonitorFunction_SvcDesc%..ServiceType = %SERVICE_KERNEL_DRIVER%..StartType = %SERVICE_DEMAND_START%..ErrorControl = %SERVICE_ERROR_NORMAL%..ServiceBinary = %12%\TVMonitor.sys..LoadOrderGroup = Extended Base....[MonitorFunction_Files_Driver]..TVMonito

C:\Program Files (x86)\TeamViewer\x64\TVMonitor.sy_ (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	B7CA6668278FBAE3FBD649285F8CCC35
SHA1:	DD5CD2FB0E6818EB56268F0D6E72D0F5AC74AEF4
SHA-256:	78318C6A8AE65FB3AFE6BA06CF1BDA69903390E250950D3BF78895CD79AFD4D8
SHA-512:	7305B979ABBEF7BEB4789261E9FC0EBDE00415BB00ECEEE2289CD1FCF91467CCC7C84ED77E7F5CD042243508B5FC8C3384EA59D6A1A17497781110FE5238103C
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..S%.S%.S%.S%.s%.Z]I.P%.Z]O.Q%.Z]Y.W%.Z]P.R%.Z]N.R%.Z]K.R%.RichS%.................PE..d...)x.Y..........".................d`.......................................................................................................`..(....p.......@.......(...............!............................................... ...............................text............................... ..h.rdata..t.... ......................@..H.data... ....0......................@....pdata.......@......................@..HPAGE....z....P...................... ..`INIT....x....`...................... ....rsrc........p.......$..............@..B........................................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\x64\TeamViewerVPN.cat (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	5CFFE65F36B60BC151486C90382F1627
SHA1:	F2A66EAE89B4B19D4CAB2AC630536AF5EEEEF121
SHA-256:	AA7C09A817EB54E3CC5C342454608364A679E231824F83BA5A2D0278EDCC1851
SHA-512:	1BD48EF66F8714E7E9591043D03BD69A30881ED3D0F2463B15750A3282DF667FFB076B3A92358EECEDAE0E54485B07D702667E8FE0AF64C52BE04DB47145920B
Malicious:	false
Reputation:	unknown
Preview:	0.)....H........).0.)~...1.0...+......0.....+.....7......0...0...+.....7.....^FZ..t.K.........071228163009Z0...+.....7.....0..^0....R2.A.7.0.D.C.D.3.9.1.4.6.4.C.B.8.D.3.7.3.6.3.2.2.E.0.7.E.9.6.6.E.1.0.5.D.3.9.6.E...1..O0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...i.n.f...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........p..FL..sc".~.n.]9n0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.7.C.A.9.7.9.F.2.2.A.E.3.2.A.2.6.8.5.5.1.C.A.1.9.6.2.C.D.9.5.2.F.D.E.2.3.8.6.9...1..W0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........".2.hU...,.R..8i...L0..H0

C:\Program Files (x86)\TeamViewer\x64\TeamViewerVPN.inf (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	447FC733747DB11CD4492AE01C5652FE
SHA1:	2A70DCD391464CB8D3736322E07E966E105D396E
SHA-256:	A817B0E8A669D5ACAF2DDFBC95ACF2A1213B092B44DC896A0EE4A5301D06EBC3
SHA-512:	238099DB072AF55445D421E941944ABE8A6F52A124A26CAE84C1DD52FFFAFC4DAC5586D0C7407B461CD0DB8E771E1DBB6CA34AEE84581B24347F401410B2AFE5
Malicious:	false
Reputation:	unknown
Preview:	; ***************************************************************************..; Copyright (C) 2007 TeamViewer GmbH.. ..; ***************************************************************************......[Version].. Signature = "$Windows NT$".. CatalogFile = teamviewervpn.cat.. ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}.. Provider = %Provider%.. Class = Net.. DriverVer=11/27/2007,2.10.00.0000....[Strings].. DeviceDescription = "TeamViewer VPN Adapter".. Provider = "TeamViewer GmbH"....;----------------------------------------------------------------..; Manufacturer + Product Section (Done)..;----------------------------------------------------------------..[Manufacturer].. %Provider% = teamviewervpn,NTamd64....[teamviewervpn.NTamd64].. %DeviceDescription% = teamviewervpn.ndi, teamviewervpn....;---------------------------------------------------------------..; Driver Section (Don

C:\Program Files (x86)\TeamViewer\x64\TeamViewerVPN.sy_ (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	F5520DBB47C60EE83024B38720ABDA24
SHA1:	BC355C14A2B22712B91FF43CD4E046489A91CAE5
SHA-256:	B8E555D92440BF93E3B55A66E27CEF936477EF7528F870D3B78BD3B294A05CC0
SHA-512:	3C5BB212467D932F5EAA17A2346EF8F401A49760C9C6C89C6318A1313FCBABB1D43B1054692C01738EA6A3648CC57E06845B81BECB3069F478D5B1A7CBCB0E66
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mN... ... ... ...... ...N... ...!... ...[... ...]... ...M... ...Q... ...\... ...X... .Rich.. .........................PE..d.....`G.........."......Z..........................................................\|......................................................0...<....................t..(...........0q...............................................p..(............................text....P.......R.................. ..h.rdata.......p.......V..............@..H.data...x............`..............@....pdata...............b..............@..HINIT.................f.............. ....rsrc................n..............@..B.reloc..<............r..............@..B................................................................................................................................................................................................................

C:\Program Files (x86)\TeamViewer\x64\teamviewervpn.sys (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	F5520DBB47C60EE83024B38720ABDA24
SHA1:	BC355C14A2B22712B91FF43CD4E046489A91CAE5
SHA-256:	B8E555D92440BF93E3B55A66E27CEF936477EF7528F870D3B78BD3B294A05CC0
SHA-512:	3C5BB212467D932F5EAA17A2346EF8F401A49760C9C6C89C6318A1313FCBABB1D43B1054692C01738EA6A3648CC57E06845B81BECB3069F478D5B1A7CBCB0E66
Malicious:	false
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mN... ... ... ...... ...N... ...!... ...[... ...]... ...M... ...Q... ...\... ...X... .Rich.. .........................PE..d.....`G.........."......Z..........................................................\|......................................................0...<....................t..(...........0q...............................................p..(............................text....P.......R.................. ..h.rdata.......p.......V..............@..H.data...x............`..............@....pdata...............b..............@..HINIT.................f.............. ....rsrc................n..............@..B.reloc..<............r..............@..B................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jun 10 20:28:06 2024, mtime=Mon Jun 10 20:28:15 2024, atime=Mon Mar 9 11:12:51 2020, length=49966712, window=hide
Category:	dropped
Size (bytes):	1116
Entropy (8bit):	4.703895720063994
Encrypted:	false
SSDEEP:
MD5:	D414AD1E5C357610A03D2BF89E9F4CA2
SHA1:	D3043C94F90845DB00242A5F3E23098FE9E92885
SHA-256:	C3B3831EF6556DF013090EF87A8D2048114F07B7B5D465E26338237221CC8F37
SHA-512:	C01F058AA624F9E5368D9C786CC9F0BC303702ED3A638EFBD56BB52CDBB15ABAEDF19870749225E1D56BF6A3B1E3AF8025B4865A79464A12FED2957AE8ABD1B2
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...(...}....J..}..........xn...........................P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V......m..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....^.1......X....TEAMVI~1..F.......X...X............................qW..T.e.a.m.V.i.e.w.e.r.....j.2.xn..iP.a .TEAMVI~1.EXE..N.......X...X............................\.L.T.e.a.m.V.i.e.w.e.r...e.x.e......._...............-.......^............6[p.....C:\Program Files (x86)\TeamViewer\TeamViewer.exe..<.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.a.m.V.i.e.w.e.r.\.T.e.a.m.V.i.e.w.e.r...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.a.m.V.i.e.w.e.r.........................@Z\|...K.J.........`.......X.......715575...........hT..CrF.f4... ....F...../....%..hT..CrF.f4... ....F...../....%.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4

C:\Users\Default\AppData\Roaming\Microsoft\Windows\SendTo\TeamViewer.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	MS Windows shortcut, Item id list present, Has Relative path, Has Working directory, Has command line arguments, ctime=Sun Dec 31 23:06:32 1600, mtime=Sun Dec 31 23:06:32 1600, atime=Sun Dec 31 23:06:32 1600, length=0, window=hide
Category:	dropped
Size (bytes):	872
Entropy (8bit):	3.387222560255355
Encrypted:	false
SSDEEP:
MD5:	AF4A9EAA8459ABDA5A6699740958DF4A
SHA1:	1C15ACA86AA16D25A886D8A9C5DDEEA180C0BCC7
SHA-256:	8C0C18712887EA36DD9D7149874393835C0C47938EEB25E686F00AE79305A9C9
SHA-512:	426DE621165236D7D270B053115ACC79D1269B0AADBA7D444799A69E9B93B6374B9D1BDAF0C304096B67C36AB352344740B410E79E5F22EA86987A3FDA5FB3A7
Malicious:	false
Reputation:	unknown
Preview:	L..................F........................................................u....P.O. .:i.....+00.../C:\...................z.1...........Program Files (x86).X............................................P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...".`.1...........TeamViewer..F............................................T.e.a.m.V.i.e.w.e.r.....l.2...........TeamViewer.exe..N............................................T.e.a.m.V.i.e.w.e.r...e.x.e.......B.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.a.m.V.i.e.w.e.r.\.T.e.a.m.V.i.e.w.e.r...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.a.m.V.i.e.w.e.r...-.-.s.e.n.d.t.o.........*................@Z\|...K.J.....................1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-.2.4.7.6.7.5.6.6.3.4.-.1.0.0.3.................

C:\Users\Public\Desktop\TeamViewer.lnk

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Archive, ctime=Mon Jun 10 20:28:06 2024, mtime=Mon Jun 10 20:28:07 2024, atime=Mon Mar 9 11:12:51 2020, length=49966712, window=hide
Category:	modified
Size (bytes):	1104
Entropy (8bit):	4.700590926314294
Encrypted:	false
SSDEEP:
MD5:	F7B4D7090B2BEE91EA505F9772D934C5
SHA1:	A5EE0CE0E4B63C2890500DAB790F2467695CF68E
SHA-256:	235993934C385C63221AB6763A04ECCC1B28F545969510E0C5A0CB5B6D7B9383
SHA-512:	DE759193274CE16CEC8C102845CE2C39672798FE385489A6099A8A66D9971BF7A747653272560E9B6D5E952949A919958700153FBCE44CB5E1837C531A3AC04C
Malicious:	false
Reputation:	unknown
Preview:	L..................F.... ...(...}...x.2.}..........xn...........................P.O. .:i.....+00.../C:\.....................1......X....PROGRA~2.........O.I.X......................V......m..P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.)...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.8.1.7.....^.1......X....TEAMVI~1..F.......X...X............................qW..T.e.a.m.V.i.e.w.e.r.....j.2.xn..iP.a .TEAMVI~1.EXE..N.......X...X............................\.L.T.e.a.m.V.i.e.w.e.r...e.x.e......._...............-.......^............6[p.....C:\Program Files (x86)\TeamViewer\TeamViewer.exe..6.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.a.m.V.i.e.w.e.r.\.T.e.a.m.V.i.e.w.e.r...e.x.e.!.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s. .(.x.8.6.).\.T.e.a.m.V.i.e.w.e.r.........................@Z\|...K.J.........`.......X.......715575...........hT..CrF.f4... ....F...../....%..hT..CrF.f4... ....F...../....%.............1SPS.XF.L8C....&.m.q............/...S.-.1.-.5.-.2.1.-.2.2.4.6.1.2.2.6.5.8.-.3.6.9.3.4.0.5.1.1.7.-

C:\Users\user\AppData\Local\Temp\TeamViewer\TV15Install.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ASCII text, with CRLF, LF line terminators
Category:	modified
Size (bytes):	34372
Entropy (8bit):	5.484022085444547
Encrypted:	false
SSDEEP:
MD5:	7327E51C9289678B0B0DCB9BCA677B86
SHA1:	97636C50C16D480519109E666CB05CE45D7A9455
SHA-256:	F8491896C3E61261BE3578919BFF2842CE316DD95E1FDE82FA2BD6FC7EA49EC5
SHA-512:	A79202F45C861E68B845B819064C72DC40F87E0BDAC6BA6FA01D5825F5E92E6827A0F3B0C95717F22FAB719033F9BDA92C00F8955C952F90E5806111740A53AF
Malicious:	false
Reputation:	unknown
Preview:	2024-06-10-17-28-01 ----------------------------------------------------------------------------------------------------..2024-06-10-17-28-01 Installer: TeamViewer..2024-06-10-17-28-01 Version: 15.3.8497..2024-06-10-17-28-01 Install mode: Admin..2024-06-10-17-28-01 Account type: Admin, UAC supported:1, Elevation:2..2024-06-10-17-28-01 Time: 2024-06-10-17-28-01..2024-06-10-17-28-01 OS-Version: 10.0.19045(64-bit) SP:0, Type:1..2024-06-10-17-28-01 OS-Info: Server:0 Home server:0..2024-06-10-17-28-01 User-SID: S-1-5-21-2246122658-3693405117-2476756634-1003..2024-06-10-17-28-01 Log level: 100 (default)..2024-06-10-17-28-01 ----------------------------------------------------------------------------------------------------..2024-06-10-17-28-01 ..2024-06-10-17-28-01 TVInitRollback(): create scheduled task for restore..2024-06-10-17-28-01 Create backup directory:<C:\Users\user\AppData\Local\Temp\TeamViewer\TVInstallTemp>..2024-06-10-17-28-

C:\Users\user\AppData\Local\Temp\TeamViewer\TVInstallTemp\TVFile139.bak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1644), with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	DC2173761DFCCC73431D65243E915534
SHA1:	A4077CD6D9FBE09DC11C8B069F7B557296BAFD86
SHA-256:	C7C09996DBA39C3755D3361CBCCE9514CFB81BA0A4D7A4EEB384D0E918EF066E
SHA-512:	056D42833C60B488873714C49E1FEFBFCB39C420170058FACD0A4421EAFFB5C90BB77FA268577D50A2C1C4A4A1156C598BAD48C9DF615082F5A2DC395AF50CC2
Malicious:	false
Reputation:	unknown
Preview:	..T.e.a.m.V.i.e.w.e.r... .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g.............B.e.f.i.n.d.e.n. .s.i.c.h. .d.e.r. .O.r.t. .d.e.s. .E.r.w.e.r.b.s. .o.d.e.r. .I.h.r. .H.a.u.p.t.(.w.o.h.n.).s.i.t.z. .a.u...e.r.h.a.l.b. .d.e.r. .U.S.A.,. .S...d.a.m.e.r.i.k.a. .o.d.e.r. .K.a.n.a.d.a.,. .g.e.l.t.e.n. .f...r. .u.n.s.e.r. .g.e.m.e.i.n.s.a.m.e.s. .V.e.r.t.r.a.g.s.v.e.r.h...l.t.n.i.s. .d.i.e. .B.e.s.t.i.m.m.u.n.g.e.n. .d.e.r. .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g. .u.n.t.e.r. .A... .u.n.d. .C...........B.e.f.i.n.d.e.t. .s.i.c.h. .d.e.r. .O.r.t. .d.e.s. .E.r.w.e.r.b.s. .o.d.e.r. .I.h.r. .H.a.u.p.t.(.w.o.h.n.).s.i.t.z. .i.n. .d.e.n. .U.S.A.,. .S...d.a.m.e.r.i.k.a. .o.d.e.r. .i.n. .K.a.n.a.d.a.,. .g.e.l.t.e.n. .f...r. .u.n.s.e.r. .g.e.m.e.i.n.s.a.m.e.s. .V.e.r.t.r.a.g.s.v.e.r.h...l.t.n.i.s. .d.i.e. .B.e.s.t.i.m.m.u.n.g.e.n. .d.e.r. .E.n.d.b.e.n.u.t.z.e.r.-.L.i.z.e.n.z.v.e.r.e.i.n.b.a.r.u.n.g. .u.n.t.e.r. .B... .u.n.d. .C...........D.i.e. .E.n.d.b.e.n.u.t.z.

C:\Users\user\AppData\Local\Temp\TeamViewer\TVInstallTemp\TVFile140.bak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	A7DDE0BE757C9FD8B3BD4A7AF6A95439
SHA1:	B797FCEE144F193488D0CB792FFD62F0626F17CA
SHA-256:	0452616496679ADA598A7FE7B36058BAF0FDA5E747D45727544B8EC224B19CFA
SHA-512:	1B58FAAEA79AA60F4CEA481CB4837DD6FA4837D2FF39D52F7877C87EE8398BC4A1D5E052AD1031C337E4704BB129B8F2B21828EDDF2CC26E0CA9FA2CC8FE987E
Malicious:	false
Reputation:	unknown
Preview:	COPYRIGHT TEAMVIEWER..====================..siehe Lizenz.txt......COPYRIGHTS INTEGRIERTER KOMPONENTEN..===================================....Copyright (c) 2007 Henri Torgemane..All Rights Reserved.....BigInteger, RSA, Random and ARC4 are derivative works of the jsbn library..(http://www-cs-students.stanford.edu/~tjw/jsbn/)..The jsbn library is Copyright (c) 2003-2005 Tom Wu (tjw@cs.Stanford.EDU)....MD5, SHA1, and SHA256 are derivative works (http://pajhome.org.uk/crypt/md5/)..Those are Copyright (c) 1998-2002 Paul Johnston & Contributors (paj@pajhome.org.uk)....SHA256 is a derivative work of jsSHA2 (http://anmar.eu.org/projects/jssha2/)..jsSHA2 is Copyright (c) 2003-2004 Angel Marin (anmar@gmx.net)....AESKey is a derivative work of aestable.c (http://www.geocities.com/malbrain/aestable_c.html)..aestable.c is Copyright (c) Karl Malbrain (malbrain@yahoo.com)....BlowFishKey, DESKey and TripeDESKey are derivative works of the Bouncy Castle Crypto Package ..(http://www.bouncycastle.org)..

C:\Users\user\AppData\Local\Temp\TeamViewer\TVInstallTemp\TVFile152.bak (copy)

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	OpenType font data
Category:	dropped
Size (bytes):	0
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:
MD5:	E8FDF1CFD4547B86CA2C2296349ACB54
SHA1:	692A2BD8CCE1C4AC62F7CD505907AA8E21AB3B69
SHA-256:	26061147867A2C3267378A97F3897C0E3187A81B987FE8FBA570A37E1305D50B
SHA-512:	8E7F26D7F3936411446A3F2D48EA7429CFA72F229DC85C4E441F7CD6B1F91EBC90A8784854784E0F42D7E0CF3B74D9B510118E37921F37190E160B6392192634
Malicious:	false
Reputation:	unknown
Preview:	OTTO.......0CFF ......(...(FFTM{..6...x....GDEF.'.D...P...&OS/2..... ...`cmapqxM.........head.iO........6hhea.Y.5.......$hmtxP'.`.......xmaxp..P.........name..=.........post...2....... ........8..._.<..........W.......z.............................Z...........................P................................1..............................PfEd...7.w. .8.Z................. . ...................6...........k...........................................................I.........4.............Q...........x.........0...................................../.C.r.e.a.t.e.d. .b.y. .T.e.a.m.V.i.e.w.e.r. .G.m.b.H..Created by TeamViewer GmbH..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15..M.e.d.i.u.m..Medium..T.e.a.m.V.i.e.w.e.r.1.5. .:. .2.7.-.9.-.2.0.1.9..TeamViewer15 : 27-9-2019..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15..V.e.r.s.i.o.n. .0.1.5...1.0. ..Version 015.10 ..T.e.a.m.V.i.e.w.e.r.1.5..TeamViewer15....................\|...........`...........8.T.V.a.e.i.m.r.w.....7.A.V.a.e.i.m.r.w..................

C:\Users\user\AppData\Local\Temp\TeamViewer\TVversion15.txt

Download File

Process:	C:\Program Files (x86)\TeamViewer\TeamViewer.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	35
Entropy (8bit):	4.479143374026009
Encrypted:	false
SSDEEP:
MD5:	A85B3E8C78935AC80C397BFB8069CC2C
SHA1:	213D9BF0CD47771016C64ECDEF25F825B5941CF6
SHA-256:	257E7B2C21C4D262B039A83FE26EBE0846F3649368680C1A2D4C758D8133EE01
SHA-512:	C4C59D0D36BB7D725E3E6119F1875484A4C41D3618ED3EDB708FFBF8BE52D413C4ABD5C56BB6AB1A598776E36F1960EC60CC670E5098F056DA52738FE515287F
Malicious:	false
Reputation:	unknown
Preview:	15.54.5..SZ4cdhX3hcU8lKOmQdfirQ==..

C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe

Download File

Process:	C:\Users\user\Desktop\TeamViewer_Setup.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	26260456
Entropy (8bit):	7.9951424122766195
Encrypted:	true
SSDEEP:
MD5:	9BAACAEAC47AAB1242A9D56A8291E3C4
SHA1:	6075F442E6B475B90936835CB8718A27477CBD44
SHA-256:	745814BF52F3394FB9B28532C585D9ED4BF8EF1EA3B1E3EBAC96705458FE6E86
SHA-512:	A13E889B3B9FBD0B0D08DF99A467C0E82CD6D59D4616507FE10DAFB81609B5A1CA7DC604F0159CDBA4B127DF452C9F518C8D41A10ED03BCEE28F8E48632B7F3B
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................b...*.......3............@.................................Ps....@.............................................@...........................................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...`...............................rsrc...@...........................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\TeamViewer\install.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	91
Entropy (8bit):	4.5577374658627745
Encrypted:	false
SSDEEP:
MD5:	A9B6EC6037725CE7F823489AD3A7CE28
SHA1:	E18C423E7FE041781D5F7B9CAF07CC2CDA7AF1CC
SHA-256:	3E80B3D1DF2EBB9E3D0D597F3B5F8964C071AD319505EF174B39226DEA97D092
SHA-512:	50ADB52BA0B4236140362EDA0E7A29235BD10A57DB06F825BA492949E94B9ABB7764393A131A6649F0E189BB5E68BDE182DA09BD37E3DFEBA5C99FA8EC2F6CE4
Malicious:	false
Reputation:	unknown
Preview:	[Installer]..CustomInstallation=0..UnattendedAccess=0..TvLicenseType=..UsageEnvironment=2..

C:\Users\user\AppData\Local\Temp\TeamViewer\tvinfo.ini

Download File

Process:	C:\Users\user\Desktop\TeamViewer_Setup.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	46
Entropy (8bit):	4.588354347173232
Encrypted:	false
SSDEEP:
MD5:	ACD6CD3DF0F488A6571D5A4723B32115
SHA1:	552CD3EEC0561FC5F58B974B3A381EF90B9A63F7
SHA-256:	CDBB63B7564A66278D31AF41F9C22A9B7D2BB2A0F186D3F7EC01CF65AC5D4614
SHA-512:	549713A40E3D4AA4AB8A08FC005D5A6A9547E12B9291C548EE9F8B7BD4BFCB0EA92D4F0A646777AD37AC4137705540BA21B56D8CA32646F96C6E1A0EE4293DDF
Malicious:	false
Reputation:	unknown
Preview:	[Installation]..INSTEXE=TeamViewer_Setup.exe..

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\FindProcDLL.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	28160
Entropy (8bit):	6.164500520000335
Encrypted:	false
SSDEEP:
MD5:	6F73B00AEF6C49EAC62128EF3ECA677E
SHA1:	1B6AFF67D570E5EE61AF2376247590EB49B728A1
SHA-256:	6EB09CE25C7FC62E44DC2F71761C6D60DD4B2D0C7D15E9651980525103AAC0A9
SHA-512:	678FC4BF7D345EEB99A3420EC7D0071EABA302845E93B48527D9A2A9C406709CC44EC74D6A889E25A8351A463803F8713A833DF3A1707A5AD50DB05240A32938
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%.C.a.-.a.-.a.-..#.j.-.'.Y.-...>.b.-.a.,.Q.-.&.b.-.).`.-.Richa.-.........................PE..L......J...........!.....N...2...............`.......................................................................h..K....d..(...............................H....................................................`...............................text....L.......N.................. ..`.rdata.......`.......R..............@..@.data...d....p.......\..............@....reloc..^............f..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\InstallOptions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	15872
Entropy (8bit):	5.470704479865464
Encrypted:	false
SSDEEP:
MD5:	033EE34C40E8FA85BF2739BCB2F3E186
SHA1:	2CA942F35F77F37DF3FC6097ACAC34F2E77341B7
SHA-256:	C91C1796338A265B49039C0B2C7A312D764B99E5174FB2DAE455CA54F8F41EC7
SHA-512:	2204E0B8721B8D85C51BD068B1695B16EE096BFC1D1CD5843F48FD04032AEEE2B6A91CE82978A4B3414F3D966EC5B36FB337A4149DAE3A1D0445935D964D247F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.px.q.+.q.+.q.+.q.+[q.+.~C+.q.+^R.+.q.+^R/+.q.+.w.+.q.+.Q.+.q.+Rich.q.+........PE..L....z.W...........!.........`.......+.......0.......................................................................8......X1..................................X....................................................0..X............................text............................... ..`.rdata..G....0......."..............@..@.data...DL...@.......,..............@....rsrc................6..............@..@.reloc..x............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\Lizenz_TeamViewer_EN_unicode.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (1265), with CRLF line terminators
Category:	dropped
Size (bytes):	209142
Entropy (8bit):	3.3343863811167216
Encrypted:	false
SSDEEP:
MD5:	0DDEE6C004727D21480D791DCDF074D7
SHA1:	581771A99D59841BD7FDC14BCDA717F14C3C3714
SHA-256:	DFE1A09EC95181998486AB9CB79D0AF1119125ED0EF2EDA0A0B1DAB86F4EB2F3
SHA-512:	5E305B16D224FD713F246EFF849B33798DFAA69CCA8793915383E14C677C713718F640CE51255C01C017625ADCC750FE43E4D780FC4104C0726288A5FFB8D2F3
Malicious:	true
Reputation:	unknown
Preview:	..T.e.a.m.V.i.e.w.e.r. .E.n.d.-.U.s.e.r. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t.........I.f. .t.h.e. .p.l.a.c.e. .o.f. .p.u.r.c.h.a.s.e. .o.r. .y.o.u.r. .m.a.i.n. .s.e.a.t. .o.r. .r.e.s.i.d.e.n.c.e. .i.s. .l.o.c.a.t.e.d. .o.u.t.s.i.d.e. .t.h.e. .U.S.A.,. .S.o.u.t.h. .A.m.e.r.i.c.a.,. .o.r. .C.a.n.a.d.a.,. .o.u.r. .c.o.n.t.r.a.c.t.u.a.l. .a.g.r.e.e.m.e.n.t. .s.h.a.l.l. .b.e. .s.u.b.j.e.c.t. .t.o. .t.h.e. .p.r.o.v.i.s.i.o.n.s. .o.f. .t.h.e. .E.n.d. .U.s.e.r. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t. .u.n.d.e.r. .A... .a.n.d. .C...........I.f. .t.h.e. .p.l.a.c.e. .o.f. .p.u.r.c.h.a.s.e. .o.r. .y.o.u.r. .m.a.i.n. .s.e.a.t. .o.r. .r.e.s.i.d.e.n.c.e. .i.s. .l.o.c.a.t.e.d. .i.n. .t.h.e. .U.S.A.,. .S.o.u.t.h. .A.m.e.r.i.c.a.,. .o.r. .C.a.n.a.d.a.,. .o.u.r. .c.o.n.t.r.a.c.t.u.a.l. .a.g.r.e.e.m.e.n.t. .s.h.a.l.l. .b.e. .s.u.b.j.e.c.t. .t.o. .t.h.e. .p.r.o.v.i.s.i.o.n.s. .o.f. .t.h.e. .E.n.d. .U.s.e.r. .L.i.c.e.n.s.e. .A.g.r.e.e.m.e.n.t. .u.n.d.e.r. .B... .a.n.d. .C...........T.h.e. .o.r.i.g.i.n.a.l. .o.f.

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	11776
Entropy (8bit):	5.6557532861400945
Encrypted:	false
SSDEEP:
MD5:	0FF2D70CFDC8095EA99CA2DABBEC3CD7
SHA1:	10C51496D37CECD0E8A503A5A9BB2329D9B38116
SHA-256:	982C5FB7ADA7D8C9BC3E419D1C35DA6F05BC5DD845940C179AF3A33D00A36A8B
SHA-512:	CB5FC0B3194F469B833C2C9ABF493FCEC5251E8609881B7F5E095B9BD09ED468168E95DDA0BA415A7D8D6B7F0DEE735467C0ED8E52B223EB5359986891BA6E2E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....z.W...........!..... ...........'.......0...............................`.......................................2.......0..P............................P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\TvGetVersion.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	215040
Entropy (8bit):	6.387247249529619
Encrypted:	false
SSDEEP:
MD5:	05F51BC8FFB2C8F5A2825BF5680301CF
SHA1:	30F7F77DCE1FB3526142780E9F5BD5C11622D6B6
SHA-256:	C67CBD5E35E1CE0C7BA17C55D8E2BC33AFD5E0A68774554A1FE7216D330C709E
SHA-512:	1E041AAA37DD00414AD955EBC8C0F708589014D2085A5A0B95A31F4D694BB1CC4994BB1324D4B983CBAD0449FB0A05560D82C60FDBFC78BE67FF61275E451233
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........4.u.U.&.U.&.U.&.#.&.U.&.-&&.U.&.U.&1U.&..+&.U.&...&.U.&.v.&.U.&...&.U.&...&.U.&..(&.U.&Rich.U.&........PE..L....>VZ...........!.....@..........s........P......................................qP....@..........................................................................................................................P...............................text....>.......@.................. ..`.rdata.......P.......D..............@..@.data....W... ......................@....rsrc...............................@..@.reloc...'.......(... ..............@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\UAC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18432
Entropy (8bit):	5.858723390475489
Encrypted:	false
SSDEEP:
MD5:	113C5F02686D865BC9E8332350274FD1
SHA1:	4FA4414666F8091E327ADB4D81A98A0D6E2E254A
SHA-256:	0D21041A1B5CD9F9968FC1D457C78A802C9C5A23F375327E833501B65BCD095D
SHA-512:	E190D1EE50C0B2446B14F0D9994A0CE58F5DBD2AA5D579F11B3A342DA1D4ABF0F833A0415D3817636B237930F314BE54E4C85B4DB4A9B4A3E532980EA9C91284
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......DH.".)lq.)lq.)lq.)mqP)lq.!1q.)lq./jq.)lqT.]q.)lq..hq.)lqRich.)lq........................PE..L...lKPJ...........!.....4...........:.......P......................................i/...............................B..J....:..x....`.......................p..........................................................L............................text...Z3.......4.................. ..`.data........P.......8..............@....rsrc........`.......@..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\UserInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	4096
Entropy (8bit):	3.2985268507239933
Encrypted:	false
SSDEEP:
MD5:	9B0DB6A6056E8E51AC35E602AEAB769F
SHA1:	B541C6D2635141CDC3A74F59D55DB8DF4A92E7AC
SHA-256:	925D80C31702A95D58EDE91EE97FD842DE78CA6DDE69156A6C1A755FBA93CD5C
SHA-512:	83FE9D346835940A37E0E0A18D041C9D13FC95A0E9ECE3BC18E555CF0E8E7DDF7B42DBA422B1E55ACE31DB3C9FC807E0B44E93B8F07F5ACB943EAAF77B4F0AC6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L....z.W...........!................j........ ...............................P...................................... "......L ..<............................@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\advanced_unicode.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.6031642286014898
Encrypted:	false
SSDEEP:
MD5:	F68824A4130EBAF6BC7AB0F62256D7D7
SHA1:	40AF19A0D92B3C9E1A8B1EAAB7D12C69E5DF436A
SHA-256:	CD8149A2E89373075EE6DB800B7F2496BACBFE21B23E4A06A3453632503B3965
SHA-512:	6A173AAA183BE0E5A516CAD484802DAE1FC53A414F870F93EA846A9EF9F9DF35153766EF632EB5E8CED8F94C2ED09A9DECDF3465D46B0DCC44A6918D88E242CB
Malicious:	false
Reputation:	unknown
Preview:	..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.6.....R.T.L.=.0.........[.F.i.e.l.d. .2.].....T.y.p.e.=.T.e.x.t.....L.e.f.t.=.1.0.....T.o.p.=.1.4.....R.i.g.h.t.=.1.7.3.....B.o.t.t.o.m.=.2.6.....S.t.a.t.e.=.C.:.\.P.r.o.g.r.a.m.m.e.\.T.e.a.m.V.i.e.w.e.r.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.0.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.7.....T.e.x.t.=.D.e.s.t.i.n.a.t.i.o.n. .d.i.r.:.........[.F.i.e.l.d. .3.].....T.y.p.e.=.B.u.t.t.o.n.....L.e.f.t.=.1.8.9.....T.o.p.=.1.2.....R.i.g.h.t.=.2.6.9.....B.o.t.t.o.m.=.2.7.....T.e.x.t.=.B.r.o.w.s.e...........F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .4.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.3.6.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.4.5.....T.e.x.t.=.I.n.s.t.a.l.l. .T.e.a.m.V.i.e.w.e.r. .P.r.i.n.t.e.r. .D.r.i.v.e.r.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .5.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.5.5.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.6.4.....T.e.x.t.

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\ioSpecial.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	548
Entropy (8bit):	3.6407531174082775
Encrypted:	false
SSDEEP:
MD5:	61D160572D2D2806B476C9E2B85DBE13
SHA1:	E53A70716001E5D5565BCBD626247DCE3F4DCF04
SHA-256:	2212C10C542133657ADA2454C2ECF1F068FA834C379BA11AAA99D790D6A87FCD
SHA-512:	ECDEA032B35BF134DB0CC984A70D0BEE2226B6C00381DB290F5B650E18625138DDA9333262269325B7FDF9EB8A48541DCBA0F882AC6A213346982A2681D2990F
Malicious:	false
Reputation:	unknown
Preview:	..[.S.e.t.t.i.n.g.s.]...R.e.c.t.=.1.0.4.4...N.u.m.F.i.e.l.d.s.=.3...R.T.L.=.0.....[.F.i.e.l.d. .1.]...T.y.p.e.=.b.i.t.m.a.p...L.e.f.t.=.0...R.i.g.h.t.=.1.0.9...T.o.p.=.0...B.o.t.t.o.m.=.1.9.3...F.l.a.g.s.=.R.E.S.I.Z.E.T.O.F.I.T...T.e.x.t.=.C.:.\.U.s.e.r.s.\.t.o.r.r.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.i.C.A.F.A...t.m.p.\.m.o.d.e.r.n.-.w.i.z.a.r.d...b.m.p.....[.F.i.e.l.d. .2.]...T.y.p.e.=.l.a.b.e.l...L.e.f.t.=.1.2.0...R.i.g.h.t.=.3.1.5...T.o.p.=.1.0...[.F.i.e.l.d. .3.]...T.y.p.e.=.l.a.b.e.l...L.e.f.t.=.1.2.0...R.i.g.h.t.=.3.1.5.....

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\linker.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	46080
Entropy (8bit):	6.178303301960086
Encrypted:	false
SSDEEP:
MD5:	4AC3F0AB2E423515ED9C575333342054
SHA1:	A3E4F2B2135157F964D471564044B023A64F2532
SHA-256:	F223D6C72F86544B358A6301DAF60CCDD86198F32E3447A1860ACF3F59F2DAE9
SHA-512:	8FBD5B4989BE51C27FA15AF155D2921BEA9AA5D0557A22D4224256E678DFE7DCAA5F80917A748C31DC9C9A91573E4618E2497CCFD47EEFD7A0FA08C12366A1E5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6e..X6..X6..X6...6..X6..Y6..X6.X.6..X6..%6..X6..66..X6..56..X6.."6..X6..$6..X6.. 6..X6Rich..X6........PE..L......Q...........!.....n...N.......................................................,.................................d......d.......x..............................................................@............................................text....m.......n.................. ..`.rdata..4........ ...r..............@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Reputation:	unknown
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsArray.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	6.182754987468525
Encrypted:	false
SSDEEP:
MD5:	82D49C227928741F6F09C5CEA3BDE9F1
SHA1:	B0904368A5E94026D0CA5760D4577236F796051D
SHA-256:	8BC5E75BBFA5A8F10526AEC2AF441153B2883D6D288726ED8F7C9AF12A1EE02B
SHA-512:	D4F588E3613886E3DAB58330CD69CE7F24C39BE2C4854CC8EDFCEF98E1324926FCDE0D79DF1A8FDF5E2BF9327B17F22A9FA1396568C0ACE4E46D4F548FDC7530
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%)y.aH..aH..aH..h0..dH..aH..jH..h0..`H..z..cH..z..`H..z..`H..z..`H..RichaH..........................PE..L.....iO...........!.............p..0.....................................................@.........................$.......X...........X..........................................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	6656
Entropy (8bit):	5.140229856656103
Encrypted:	false
SSDEEP:
MD5:	01E76FE9D2033606A48D4816BD9C2D9D
SHA1:	E46D8A9ED4D5DA220C81BAF5F1FDB94708E9ABA2
SHA-256:	EE052FD5141BF769B841846170AABF0D7C2BB922C74C623C3F109344534F7A70
SHA-512:	62EF7095D1BF53354C20329C2CE8546C277AA0E791839C8A24108A01F9483A953979259E0AD04DBCAB966444EE7CDD340F8C9557BC8F98E9400794F2751DC7E0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....z.W...........!......................... ...............................P.......................................$..l.... ..P............................@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	179712
Entropy (8bit):	6.382819581405801
Encrypted:	false
SSDEEP:
MD5:	87853C0F20F065793BDC707ECE66190B
SHA1:	738E11A9A565923EC75400A0CD4BCE4DB257B21D
SHA-256:	66B2F36274DDFEEF35B1D6AE6E5755F834446E5D78A719063347543793987161
SHA-512:	FEBFCD11795F4EF0FF3D25CBF1856BE01E7F6423A9F16028C927988C04AB21DE5F0B076D7F4CE9294AA7603C0DB61EA5FFB888AF2E9F7C6A6A11BCABFE9795A2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.I............7y......7y..9...7y..c...........................i.....7y..~...7y......7y......7y......Rich............................PE..L......M...........!.................w....................................... ...................................... {.......q..P.......H.......................0...................................8;..@............................................text............................... ..`.rdata...k.......l..................@..@.data...._...........p..............@....rsrc...H...........................@..@.reloc...........0..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsiCAFA.tmp\start_unicode.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2704
Entropy (8bit):	3.6528458499708383
Encrypted:	false
SSDEEP:
MD5:	65D57DD5A51F3F59EC0087F0772C19D1
SHA1:	B141CD9B04807F3B32F7BEBA23DA423A4DB1C79A
SHA-256:	2BD3DAEBB1BF5F5B353726BD86A3394D3898199B1828BE7F6B760909A89C9AA7
SHA-512:	9519C9D26E60AE67E1555465AFEF1194B5B36965E45D67048F56E076B5AEE21CC8FE05070BB320F295179498D7B0543FFFFB084235F14672F3E5E113E223E251
Malicious:	false
Reputation:	unknown
Preview:	..;. .A.u.t.o.-.g.e.n.e.r.a.t.e.d. .b.y. .E.c.l.i.p.s.e.N.S.I.S. .I.n.s.t.a.l.l.O.p.t.i.o.n.s. .S.c.r.i.p.t. .W.i.z.a.r.d.....;. .3.0...0.1...2.0.0.6. .1.1.:.1.9.:.5.5.....[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.1.0.....R.T.L.=.0.....S.t.a.t.e.=.0.........[.F.i.e.l.d. .8.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.1.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.1.0.....T.e.x.t.=.H.o.w. .d.o. .y.o.u. .w.a.n.t. .t.o. .p.r.o.c.e.e.d.?.....H.W.N.D.=.2.6.2.8.2.2.........[.F.i.e.l.d. .1.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.1.3.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.2.9.....T.e.x.t.=.D.e.f.a.u.l.t. .i.n.s.t.a.l.l.a.t.i.o.n.....S.t.a.t.e.=.1.....F.l.a.g.s.=.G.R.O.U.P.\|.N.O.T.I.F.Y.....H.W.N.D.=.1.9.7.3.4.8.........[.F.i.e.l.d. .9.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.8.2.....R.i.g.h.t.=.1.8.9.....B.o.t.t.o.m.=.9.1.....T.e.x.t.=.H.o.w. .d.o. .y.o.u. .w.a.n.t. .t.o. .u.s.e. .T.e.a.m.V.i.e.w.e.r.?.....H.W.N.D.=.4.5.9.3.5.2.........[.F.i.

C:\Users\user\AppData\Local\Temp\nslC462.tmp\TvGetVersion.dll

Download File

Process:	C:\Users\user\Desktop\TeamViewer_Setup.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	198144
Entropy (8bit):	6.617636400271687
Encrypted:	false
SSDEEP:
MD5:	D2AC4CA57F4B624C444C17E8A353DEAA
SHA1:	D713B2B4FF0CEC01B5C89BD26127012EED460A32
SHA-256:	A4DB659C6265BA7EFBBD4906257EF6CDB8F9B1FEFBA78F01425390729AB3D1F2
SHA-512:	DB991671548D9F239ACF7B77B47CCBF438C626E803026A68D7C67EC5B3923195C8745F6ADBE730FE4C049237217849F8F9F47FC335CF94B1413A7DEBC9B8D9B1
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 2%
Reputation:	unknown
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........o.cL..0L..0L..0#x.0I..0Ev70U..0L..0...0W.:0[..0W..0...0.-.0M..0W..0z..0W.?0M..0W.90M..0RichL..0................PE..L....>VZ...........!................I........@...............................p......}.....@..........................................0.......................@.......................................................@...............................text....-.......................... ..`.rdata.......@.......2..............@..@.data....H..........................@....rsrc........0......................@..@.reloc...&...@...(..................@..B........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsnC944.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	29160633
Entropy (8bit):	7.769637880510292
Encrypted:	false
SSDEEP:
MD5:	FA43BA21B74655715F402AAA9879C53A
SHA1:	2DD2A7987F3EF9811213A7BAA99B91A7AF94B299
SHA-256:	715ECD561CBA5A7CF42959BEFA0D4E427AEACD1A9707A9BDFF2223F1ED9C40F9
SHA-512:	C6E148E2C66185C81B3F8317254BA73824F4E48528AB035AA356FBCD62B0862DF5A79BD5CF249214B2F6CED91EC7E490BDBB7E23A5B7859F8ECDECD1E8815AC8
Malicious:	false
Reputation:	unknown
Preview:	..".....,........................A........".!...P.".........................U...i...............................'...........6...............................................................................................................................................................G...J...........$...........7.......j.......................................................................................................................................................................................................................................................................T.......................................j.......................T...............................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\TeamViewer\TeamViewer15_Logfile.log

Download File

Process:	C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	966
Entropy (8bit):	5.014281194416933
Encrypted:	false
SSDEEP:
MD5:	29D1ED0CA313E3978B17E8021EC9CBFA
SHA1:	DA4822BE3BE252A86EDB677CC03DACA0D23A360E
SHA-256:	D2FB7218B7301FF4E201FE75CC533A191D81A6855420F610300B411627C35007
SHA-512:	45C7CC5C1E9AE11B80793539FAB8A7FE571454E46939094F005EE30306112D90F1FEF424E68790ECE566C4A5CE70AC1E0D4FBA4630F2A2175DDD834CEC1E9730
Malicious:	false
Reputation:	unknown
Preview:	2024/06/10 17:28:17.798 1240 828 I1 IsWindowsServerVerifyOnce(): Is a windows server 0..2024/06/10 17:28:17.798 1240 828 I1 Logger started...2024/06/10 17:28:17.846 1240 828 I1 Service install: Param:'-install'..2024/06/10 17:28:18.052 1240 828 I1+ GetSimpleDisplayCertNameFromFile: Found cert name: 'TeamViewer Germany GmbH'...2024/06/10 17:28:18.052 1240 828 I1+ VerifyTeamViewerCertificate: File for loading certificate is C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe..2024/06/10 17:28:18.068 1240 828 I1+ VerifyTeamViewerCertificate: SHA256 code path...2024/06/10 17:28:18.068 1240 828 I1+ SHA256 certificate check...2024/06/10 17:28:18.068 1240 828 I1+ VerifyCertHash(): Certificate check succeded...2024/06/10 17:28:18.068 1240 828 I1+ ServiceConfiguration: Creating service..2024/06/10 17:28:18.068 1240 828 I1 Service TeamViewer at "C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe" installed..

C:\Windows\ServiceProfiles\LocalService\AppData\Local\Temp\MpCmdRun.log

Download File

Process:	C:\Program Files\Windows Defender\MpCmdRun.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2464
Entropy (8bit):	3.2492262213420755
Encrypted:	false
SSDEEP:
MD5:	CF12DB522F5D4B3DD43BA639EDD88351
SHA1:	171FF2D6C85A0F3F7EAFE501E2655B5FDF8BF131
SHA-256:	E41CD7440CBD12834701B8E294D25C19DC1C8B5AC5489F6F7691BAA3C2DCFBC7
SHA-512:	8CE96487DF7A9C9B1EE93E3CE68EAC6F207DF59562E33296B3BCB2EDF70E17F42DD3D426D0BD4132177AA2C8867B89B548BA91D7C3F71B15B87244AA44AD5B84
Malicious:	false
Reputation:	unknown
Preview:	..........-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.-.....M.p.C.m.d.R.u.n.:. .C.o.m.m.a.n.d. .L.i.n.e.:. .".C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.\.m.p.c.m.d.r.u.n...e.x.e.". .-.w.d.e.n.a.b.l.e..... .S.t.a.r.t. .T.i.m.e.:. .. M.o.n. .. J.u.n. .. 1.0. .. 2.0.2.4. .1.7.:.2.8.:.5.6.........M.p.E.n.s.u.r.e.P.r.o.c.e.s.s.M.i.t.i.g.a.t.i.o.n.P.o.l.i.c.y.:. .h.r. .=. .0.x.1.....W.D.E.n.a.b.l.e........................................ .W.S.C. .S.t.a.t.e. .I.n.f.o. ................................................................. .A.n.t.i.V.i.r.u.s.P.r.o.d.u.c.t. ..............................d.i.s.p.l.a.y.N.a.m.e. .=. .[.W.i.n.d.o.w.s. .D.e.f.e.n.d.e.r.].....p.a.t.h.T.o.S.i.g.n.e.d.P.r.o.d.u.c.t.E.x.e. .=. .[.w.i.n.d.o.w.s.d.

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Entropy (8bit):	7.985098374755063
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	TeamViewer_Setup.exe
File size:	26'985'448 bytes
MD5:	7dd4249d398182c34691d1161d844eee
SHA1:	ca3da851cf5871c4580fa8e86b95c2c400258906
SHA256:	2e547f6118a778517fdd883c127c5e427c205a35208267014cce6fe49b63a2b3
SHA512:	9db4d174968f9dc73c1ff6d78e0cf7583c930e05b52ca1796976a90edf5935e3ae18c8aaf85190cc01664ff24171eed3d1a6bc73a9d3c2b399d1cf8551b27d24
SSDEEP:	393216:JAjZzx/1PQRxZY+F/a/aUbqu79Wmyi+QqDqp64T1UR2+UR4AJ2NqNf87yB:OjQva/DBWmSeAISE+gCP7y
TLSH:	A74733E993E356D3F8325A35D7A1823461323EC5A4F52DF956C4B63C4A702DEA30E92C
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F...v...F...@...F.Rich..F.........................PE..L....z.W.................^.........

File Icon


Icon Hash:	71e0d49292c07033

Static PE Info

General

Entrypoint:	0x4030d9
Entrypoint Section:	.text
Digitally signed:	true
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
DLL Characteristics:	DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Time Stamp:	0x57017AA7 [Sun Apr 3 20:18:47 2016 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	b78ecf47c0a3e24a6f4af114e2d1f5de

Authenticode Signature

Signature Valid:	true
Signature Issuer:	CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US
Signature Validation Error:	The operation completed successfully
Error Number:	0
Not Before, Not After	19/12/2019 01:00:00 23/12/2020 13:00:00
Subject Chain	CN=TeamViewer Germany GmbH, O=TeamViewer Germany GmbH, L=Gppingen, S=Baden-Wrttemberg, C=DE
Version:	3
Thumbprint MD5:	545BEC2FAA9BFEB2BE446B39CC98DE76
Thumbprint SHA-1:	05CDF79B0EFFFF361DAC0363ADAA75B066C49DE0
Thumbprint SHA-256:	61C15147A45994BF2AEDD5FA9818DB317CB470E6A9BBFCDE3CDA239BA8364A19
Serial:	0B446546C36525BF5F084F6BBBBA7097

Entrypoint Preview

Instruction
sub esp, 00000184h
push ebx
push esi
push edi
xor ebx, ebx
push 00008001h
mov dword ptr [esp+18h], ebx
mov dword ptr [esp+10h], 00409198h
mov dword ptr [esp+20h], ebx
mov byte ptr [esp+14h], 00000020h
call dword ptr [004070A8h]
call dword ptr [004070A4h]
cmp ax, 00000006h
je 00007F8DC4839353h
push ebx
call 00007F8DC483C2C1h
cmp eax, ebx
je 00007F8DC4839349h
push 00000C00h
call eax
mov esi, 00407298h
push esi
call 00007F8DC483C23Dh
push esi
call dword ptr [004070A0h]
lea esi, dword ptr [esi+eax+01h]
cmp byte ptr [esi], bl
jne 00007F8DC483932Dh
push ebp
push 00000009h
call 00007F8DC483C294h
push 00000007h
call 00007F8DC483C28Dh
mov dword ptr [00423704h], eax
call dword ptr [00407044h]
push ebx
call dword ptr [00407288h]
mov dword ptr [004237B8h], eax
push ebx
lea eax, dword ptr [esp+38h]
push 00000160h
push eax
push ebx
push 0041ECC8h
call dword ptr [00407174h]
push 00409188h
push 00422F00h
call 00007F8DC483BEB7h
call dword ptr [0040709Ch]
mov ebp, 00429000h
push eax
push ebp
call 00007F8DC483BEA5h
push ebx
call dword ptr [00407154h]

Rich Headers

Programming Language:

[EXP] VC++ 6.0 SP5 build 8804

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x7428	0xa0	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x2f000	0x465a0	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x19b8968	0x3a80
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x7000	0x298	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x5c5b	0x5e00	3d4c7426917ca8533fbfc9cd63e19ba3	False	0.6603640292553191	data	6.411487375491561	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x7000	0x1246	0x1400	43fab6a80651bd97af8f34ecf44cd8ac	False	0.42734375	data	5.005029341587408	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x9000	0x1a7f8	0x400	00798d060e552892531c88ed1710ae2c	False	0.6376953125	data	5.108396988130901	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.ndata	0x24000	0xb000	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_CNT_UNINITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x2f000	0x465a0	0x46600	4c08bed7c5c9e347110411c32ea86cfc	False	0.09178993672291297	data	3.8032202112249776	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x2f268	0x42028	Device independent bitmap graphic, 256 x 512 x 32, image size 0	English	United States	0.07970381986566855
RT_ICON	0x71290	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	English	United States	0.187448132780083
RT_ICON	0x73838	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	English	United States	0.2568011257035647
RT_ICON	0x748e0	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	English	United States	0.4574468085106383
RT_DIALOG	0x74d48	0x100	data	English	United States	0.5234375
RT_DIALOG	0x74e48	0x11c	data	English	United States	0.6056338028169014
RT_DIALOG	0x74f68	0x60	data	English	United States	0.7291666666666666
RT_GROUP_ICON	0x74fc8	0x3e	data	English	United States	0.8064516129032258
RT_VERSION	0x75008	0x258	data	English	United States	0.48833333333333334
RT_MANIFEST	0x75260	0x340	XML 1.0 document, ASCII text, with very long lines (832), with no line terminators	English	United States	0.5540865384615384

Imports

DLL	Import
KERNEL32.dll	SetEnvironmentVariableA, Sleep, GetTickCount, GetFileSize, GetModuleFileNameA, GetCurrentProcess, CopyFileA, GetFileAttributesA, SetFileAttributesA, GetWindowsDirectoryA, GetTempPathA, GetCommandLineA, lstrlenA, GetVersion, SetErrorMode, lstrcpynA, ExitProcess, GetFullPathNameA, GlobalLock, CreateThread, GetLastError, CreateDirectoryA, CreateProcessA, RemoveDirectoryA, CreateFileA, GetTempFileNameA, ReadFile, WriteFile, lstrcpyA, MoveFileExA, lstrcatA, GetSystemDirectoryA, GetProcAddress, CloseHandle, SetCurrentDirectoryA, MoveFileA, CompareFileTime, GetShortPathNameA, SearchPathA, lstrcmpiA, SetFileTime, lstrcmpA, ExpandEnvironmentStringsA, GlobalUnlock, GetDiskFreeSpaceA, GlobalFree, FindFirstFileA, FindNextFileA, DeleteFileA, SetFilePointer, GetPrivateProfileStringA, FindClose, MultiByteToWideChar, FreeLibrary, MulDiv, WritePrivateProfileStringA, LoadLibraryExA, GetModuleHandleA, GetExitCodeProcess, WaitForSingleObject, GlobalAlloc
USER32.dll	ScreenToClient, GetSystemMenu, SetClassLongA, IsWindowEnabled, SetWindowPos, GetSysColor, GetWindowLongA, SetCursor, LoadCursorA, CheckDlgButton, GetMessagePos, LoadBitmapA, CallWindowProcA, IsWindowVisible, CloseClipboard, SetClipboardData, EmptyClipboard, PostQuitMessage, GetWindowRect, EnableMenuItem, CreatePopupMenu, GetSystemMetrics, SetDlgItemTextA, GetDlgItemTextA, MessageBoxIndirectA, CharPrevA, DispatchMessageA, PeekMessageA, ReleaseDC, EnableWindow, InvalidateRect, SendMessageA, DefWindowProcA, BeginPaint, GetClientRect, FillRect, DrawTextA, EndDialog, RegisterClassA, SystemParametersInfoA, CreateWindowExA, GetClassInfoA, DialogBoxParamA, CharNextA, ExitWindowsEx, GetDC, CreateDialogParamA, SetTimer, GetDlgItem, SetWindowLongA, SetForegroundWindow, LoadImageA, IsWindow, SendMessageTimeoutA, FindWindowExA, OpenClipboard, TrackPopupMenu, AppendMenuA, EndPaint, DestroyWindow, wsprintfA, ShowWindow, SetWindowTextA
GDI32.dll	SelectObject, SetBkMode, CreateFontIndirectA, SetTextColor, DeleteObject, GetDeviceCaps, CreateBrushIndirect, SetBkColor
SHELL32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHBrowseForFolderA, SHGetFileInfoA, ShellExecuteA, SHFileOperationA
ADVAPI32.dll	RegDeleteKeyA, SetFileSecurityA, OpenProcessToken, LookupPrivilegeValueA, AdjustTokenPrivileges, RegOpenKeyExA, RegEnumValueA, RegDeleteValueA, RegCloseKey, RegCreateKeyExA, RegSetValueExA, RegQueryValueExA, RegEnumKeyA
COMCTL32.dll	ImageList_Create, ImageList_AddMasked, ImageList_Destroy
ole32.dll	OleUninitialize, OleInitialize, CoTaskMemFree, CoCreateInstance

Possible Origin

Language of compilation system	Country where language is spoken	Map
English	United States

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Regsvr32.exe to proxy execution of malicious code. Regsvr32.exe is a command-line program used to register and unregister object linking and embedding controls, including dynamic link libraries (DLLs), on Windows systems. The Regsvr32.exe binary may also be signed by Microsoft.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Module: Module Load, Network Traffic: Network Connection Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report TeamViewer_Setup.exe

Overview

General Information

Detection

Compliance

Signatures

Classification

Process Tree

Yara Signatures

Sigma Signatures

System Summary

Snort Signatures

Joe Sandbox Signatures

Compliance

Spreading

Networking

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Mitre Att&ck Matrix

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

World Map of Contacted IPs

Public IPs

Private

General Information

Warnings

Created / dropped Files

C:\Program Files (x86)\TeamViewer\CopyRights.txt (copy)

C:\Program Files (x86)\TeamViewer\CopyRights_DE.txt (copy)

C:\Program Files (x86)\TeamViewer\CopyRights_EN.txt (copy)

C:\Program Files (x86)\TeamViewer\Lizenz_TeamViewer_DE_unicode.txt (copy)

C:\Program Files (x86)\TeamViewer\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml (copy)

C:\Program Files (x86)\TeamViewer\Printer\TeamViewer_XPSDriverFilter-manifest.ini (copy)

C:\Program Files (x86)\TeamViewer\Printer\TeamViewer_XPSDriverFilter.gpd (copy)

C:\Program Files (x86)\TeamViewer\Printer\TeamViewer_XPSDriverFilter.inf (copy)

C:\Program Files (x86)\TeamViewer\Printer\teamviewer_xpsdriverfilter.cat (copy)

C:\Program Files (x86)\TeamViewer\Printer\x64\TeamViewer_XPSDriverFilter.dll (copy)

C:\Program Files (x86)\TeamViewer\TVExtractTemp\CopyRights_DE.txt

C:\Program Files (x86)\TeamViewer\TVExtractTemp\CopyRights_EN.txt

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Lizenz_TeamViewer_DE_unicode.txt

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat

C:\Program Files (x86)\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer.exe

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer15.otf

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Note.exe

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll

C:\Program Files (x86)\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll

Windows Analysis Report
TeamViewer_Setup.exe

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may encrypt data on target systems or on large numbers of systems in a network to interrupt availability to system and network resources. They can attempt to render stored data inaccessible by encrypting files or data on local and remote drives and withholding access to a decryption key. This may be done in order to extract monetary compensation from a victim in exchange for decryption or a decryption key (ransomware) or to render data permanently inaccessible in cases where the key is not saved or transmitted.
Tactics:	Impact
Data Sources:	Cloud Storage: Cloud Storage Modification, Command: Command Execution, File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Windows
Url:	Open detailed description by Mitre