Edit tour

Windows Analysis Report
lz3EbiqoK4.exe

Overview

General Information

Sample name:	lz3EbiqoK4.exe renamed because original name is a hash value
Original sample name:	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Analysis ID:	1571838
MD5:	33c2adebfe2c3acedfb34ffff8151b7d
SHA1:	8e93f7ecafa92017a7d528423574ab5cfeec754a
SHA256:	773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd
Tags:	exeQuasarRATRATuser-abuse_ch
Infos:

Detection

Quasar

Score:	88
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Found malware configuration

Malicious sample detected (through community Yara rule)

Yara detected Quasar RAT

.NET source code contains potential unpacker

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Hides that the sample has been downloaded from the Internet (zone.identifier)

Uses schtasks.exe or at.exe to add and modify task schedules

Yara detected Generic Downloader

Allocates memory with a write watch (potentially for evading sandboxes)

Contains functionality for read data from the clipboard

Contains functionality to shutdown / reboot the system

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Drops PE files

Drops PE files to the windows directory (C:\Windows)

Drops certificate files (DER)

Drops files with a non-matching file extension (content does not match file extension)

Enables debug privileges

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

PE file contains executable resources (Code or Archives)

PE file contains more sections than normal

PE file contains sections with non-standard names

PE file does not import any functions

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Installation of TeamViewer Desktop

Sigma detected: Suspicious Add Scheduled Task Parent

Sigma detected: Suspicious desktop.ini Action

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara signature match

Classification

Process Tree

System is w10x64

lz3EbiqoK4.exe (PID: 7312 cmdline: "C:\Users\user\Desktop\lz3EbiqoK4.exe" MD5: 33C2ADEBFE2C3ACEDFB34FFFF8151B7D)

Client-built.exe (PID: 7464 cmdline: "C:\Users\user\AppData\Local\Temp\Client-built.exe" MD5: 181719B653C83D0463D89A625A7F5C3E)

TeamViewer_Setup_x64.exe (PID: 7772 cmdline: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" MD5: D15511E4B90CC6729FEDAF86D080D1F6)

TeamViewer_.exe (PID: 7820 cmdline: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" MD5: 8318FC63158C01368AADC6D4BE89FAD1)

schtasks.exe (PID: 7912 cmdline: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 7920 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 332 cmdline: C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 2872 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

TeamViewer_.exe (PID: 7968 cmdline: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE MD5: 8318FC63158C01368AADC6D4BE89FAD1)

schtasks.exe (PID: 8092 cmdline: C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F MD5: 48C2FE20575769DE916F48EF0676A965)

conhost.exe (PID: 8104 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Quasar RAT, QuasarRAT	Quasar RAT is a malware family written in .NET which is used by a variety of attackers. The malware is fully functional and open source, and is often packed to make analysis of the source more difficult.	APT33 Dropping Elephant Stone Panda The Gorgon Group	http://researchcenter.paloaltonetworks.com/2017/01/unit42-downeks-and-quasar-rat-used-in-recent-targeted-attacks-against-governments http://symantec-enterprise-blogs.security.com/blogs/threat-intelligence/bluebottle-banks-targeted-africa https://0x00sec.org/t/master-of-rats-how-to-create-your-own-tracker/20848 https://adeo.com.tr/wp-content/uploads/2020/02/APT10_Report.pdf https://asec.ahnlab.com/en/31089/	https://malpedia.caad.fkie.fraunhofer.de/details/win.quasar_rat

Malware Configuration

Threatname: Quasar

{"Version": "1.4.1", "Host:Port": "167.71.56.116:22269;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "3470ac31-30aa-4cf6-ab0a-1ed0dd64656f", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "flgSE4SpXYfH0xcfLTe0iNrh2SeQBvNG44BtoMkxQ/T+DRAgnPzzPI13Eed+g9CiOhWxTcQ4rBGiEohyz5eQ1DvqWAcx7FHBiVlioCxa9o3s2Di7DtimucOXtlSh4LTyZq/qoQbOzkeXO7/0unghQ7pjMzNB1Xr/SNB2tIRVcTdEqpy74fYJ6cocilX8Eb2i3AuEpiYlPtpqujGq/1uutyvPCEGIJu28WT9i75GrAom6etZ++VpuHWw33I16MzKdxOjLZ4w5gHdhiybBfRenF2XXPqcEFMH78okk/Jmk3sUsueppieYz3jgjrXyqIfg9Ayqy89/lJW/B6sm5q5nbX2TzhmeI0bxRl02j2TOwPVJjgx3ySJevStEV8SJEFazuggWRFjbW7A/0TAbGRgBtDu378rLxwiqWCnedkKFuSJVEYLWb1rkRnymb8kWHRFZM+wi+cmaWTdNz+u8VvAwUxUAxlfQaLYamguJbJD+MZZzRhLNIHMJm1DcnJdECI6P3rtd6d6YJI2+TdyXRb8bNg+obsU+ppH+yxLw4NlWFbvXREBZB6trXaIf3fhI+f4FbA2+lb5IJ5euHGu5FabDFvABadac+bVMBFsmLTQEKOGWnEyX038mvTSpS5MLw+NfCXIlMW94wwokBZ/0I0mEhPAflB+p9xZVJUHd3qYbTnMs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAJq3Mj8c1rXwra3rDC0BgzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIwNDA5Mzc1OFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgDdz73u2oR4NOea2y1Gy+ejcDZB7rD3j8AcyTdfqU60MW8K4UCvWDATRHvg0Q+WxaHgJjvGGAOzSgmLJF/sKanAHM+Ejhya1aOTADACluOYW9YcZ4hhpmvAgq9IZKr3VXAH6AlDVb6EYlFvNUzQMRbMzZflnnYPpoKtj96/xEllcqnYYe5iiIF25objFBsOivILrD8r5zzl30bfwt6bcs7EZ77qOOajuTqF5VPneX/C1mgSqnK1KeE4MyI6vfJvaWAQ7sjNLWflauxXUMALmiEssTwcfJ1+GOhoXngcZ6TzTQqdzBGbaEmgWvsIvZSgGu/ddDnX01P26IKwLVHCFRdDY82m3FXkPv/WpK+P95yeUA3uzIIZlbFPXr+8pdylqs/E5+b7LNIAxQRhXI4NfwAhUfLq4MhYlLh844vRdBda+7g19pW6rrU+R5BObTIE5pry54Stz+rgS9I81k7Kaqzq2MbOMYoHBSQkfH/whUILDnSvm+J/7nAm1kYbamCUZQY27NYhcHWmBEBEwSDe4K2MlHzn2nEXY7H1GRTvdCtUnHoLbGGue4J64dnTA1mL4XYWgmKjNWUcemFuo3lkQD+M3GkW5nTPlEkP6X116nlzIH1tm3fp2PRQphJvowVrcA/Ch6Me4VYt7vEV4gUPn9o+tqu2QDvFBjS+iFx8YYXcCAwEAAaMyMDAwHQYDVR0OBBYEFM0CBviNX3UM6cXNdgOhJ1Q8+Tu5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBABtf3WU07+re45SWDknjH/SP021fFZEXLh9u7mE/zGyJw2C3vhs9+47GhCp6jNjZg7NntWJboiyj4VhNHRuLnqItAPF60JGo3Q3TuSRDdCcDg/9DSdbODMg2EcH/kk1yVQgE6+qDC7H+SbNn6JgTnFTH1KesnSHl/m/Y3Bg2+ZTiJuDwxBXsAfRjSuhjaMe/k2oCWE5PngTtcSSOLbhMQ7kAZMl3++MSFe3Q8vUnpyKq5gELt1RnACtyPInqCM2gXA1rRw407+6AoyjnUo5M5/jwYIicQEJVkkJSSO7opyR1t9SNh8nrjxEtJIgsitQRrGh0vJLQYeTJDCy4RGwR8o7sruyrJcfHZjX3D1QujdUl1C6mSTR9E/LW2pEq4EkaifcG4WOejyIsspkrCDSeyWyRXjMxq4FlVGgtbzVZbIQbPOpSbDMNIHr4QKgsp0Xa/cgb830U6g5TFUNX2C7ueZrDpV0nAvOUsm2OQ9SBPLSgds4hESjjSxh2I2/WwYJl1TB642zOPUPfOuYN2xvBm9D0sZWMZe7l8ou899vN3zogGQwX1wJTyVorX/IgpNljOZDNVYSL7YEAiQI6YM03H1pkjY9EgeboVCIpWbRBvx0bjk1GRHpRM2Hst3mDU7F7AOepmS8xBatuBKRIEHWJ00a55Pb6d7CoySAxY7aN0FT7"}

Yara Signatures

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Temp\Client-built.exe	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
C:\Users\user\AppData\Local\Temp\Client-built.exe	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
C:\Users\user\AppData\Local\Temp\Client-built.exe	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab83e:$x4: Uninstalling... good bye :-( 0x2ad033:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
C:\Users\user\AppData\Local\Temp\Client-built.exe	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadf0:$f1: FileZilla\recentservers.xml 0x2aae30:$f2: FileZilla\sitemanager.xml 0x2aae72:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0be:$b1: Chrome\User Data\ 0x2ab114:$b1: Chrome\User Data\

Memory Dumps

Source	Rule	Description	Author
00000001.00000000.1927009729.0000000000420000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.3103987388.0000000002841000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
00000001.00000002.3103987388.00000000029C5000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
Process Memory Space: Client-built.exe PID: 7464	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
1.0.Client-built.exe.100000.0.unpack	JoeSecurity_Quasar	Yara detected Quasar RAT	Joe Security
1.0.Client-built.exe.100000.0.unpack	JoeSecurity_GenericDownloader_1	Yara detected Generic Downloader	Joe Security
1.0.Client-built.exe.100000.0.unpack	MAL_QuasarRAT_May19_1	Detects QuasarRAT malware	Florian Roth	0x28ee9d:$x1: Quasar.Common.Messages 0x29f1c6:$x1: Quasar.Common.Messages 0x2ab83e:$x4: Uninstalling... good bye :-( 0x2ad033:$xc2: 00 70 00 69 00 6E 00 67 00 20 00 2D 00 6E 00 20 00 31 00 30 00 20 00 6C 00 6F 00 63 00 61 00 6C 00 68 00 6F 00 73 00 74 00 20 00 3E 00 20 00 6E 00 75 00 6C 00 0D 00 0A 00 64 00 65 00 6C 00 20 ...
1.0.Client-built.exe.100000.0.unpack	INDICATOR_SUSPICIOUS_GENInfoStealer	Detects executables containing common artifcats observed in infostealers	ditekSHen	0x2aadf0:$f1: FileZilla\recentservers.xml 0x2aae30:$f2: FileZilla\sitemanager.xml 0x2aae72:$f3: SOFTWARE\\Martin Prikryl\\WinSCP 2\\Sessions 0x2ab0be:$b1: Chrome\User Data\ 0x2ab114:$b1: Chrome\User Data\ 0x2ab3ec:$b2: Mozilla\Firefox\Profiles 0x2ab4e8:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2fd46c:$b3: Software\Microsoft\Internet Explorer\IntelliForms\Storage2 0x2ab640:$b4: Opera Software\Opera Stable\Login Data 0x2ab6fa:$b5: YandexBrowser\User Data\ 0x2ab768:$b5: YandexBrowser\User Data\ 0x2ab43c:$s4: logins.json 0x2ab172:$a1: username_value 0x2ab190:$a2: password_value 0x2ab47c:$a3: encryptedUsername 0x2fd3b0:$a3: encryptedUsername 0x2ab4a0:$a4: encryptedPassword 0x2fd3ce:$a4: encryptedPassword 0x2fd34c:$a5: httpRealm
1.0.Client-built.exe.100000.0.unpack	MALWARE_Win_QuasarStealer	Detects Quasar infostealer	ditekshen	0x164f16:$s1: PGma.System.MouseKeyHook, Version=5.6.130.0, Culture=neutral, PublicKeyToken=null 0x2ab928:$s3: Process already elevated. 0x28eb9c:$s4: get_PotentiallyVulnerablePasswords 0x278c58:$s5: GetKeyloggerLogsDirectory 0x29e925:$s5: GetKeyloggerLogsDirectory 0x28ebbf:$s6: set_PotentiallyVulnerablePasswords 0x2fea9a:$s7: BQuasar.Client.Extensions.RegistryKeyExtensions+<GetKeyValues>

Sigma Signatures

System Summary

Sigma detected: Installation of TeamViewer Desktop

Source: File created

Author: frack113: Data: EventID: 11, Image: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe, ProcessId: 7820, TargetFilename: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe

Sigma detected: Suspicious Add Scheduled Task Parent

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F, CommandLine: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F, CommandLine|base64offset|contains: *j, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" , ParentImage: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe, ParentProcessId: 7820, ParentProcessName: TeamViewer_.exe, ProcessCommandLine: C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F, ProcessId: 7912, ProcessName: schtasks.exe

Sigma detected: Suspicious desktop.ini Action

Source: File created

Author: Maxime Thiebaut (@0xThiebaut), Tim Shelton (HAWK.IO): Data: EventID: 11, Image: C:\Users\user\Desktop\lz3EbiqoK4.exe, ProcessId: 7312, TargetFilename: C:\Windows\assembly\Desktop.ini

Suricata Signatures

⊘No Suricata rule has matched

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Found malware configuration

Source: 1.0.Client-built.exe.100000.0.unpack

Malware Configuration Extractor: Quasar {"Version": "1.4.1", "Host:Port": "167.71.56.116:22269;", "SubDirectory": "SubDir", "InstallName": "Client.exe", "MutexName": "3470ac31-30aa-4cf6-ab0a-1ed0dd64656f", "StartupKey": "Quasar Client Startup", "Tag": "Office04", "LogDirectoryName": "Logs", "ServerSignature": "flgSE4SpXYfH0xcfLTe0iNrh2SeQBvNG44BtoMkxQ/T+DRAgnPzzPI13Eed+g9CiOhWxTcQ4rBGiEohyz5eQ1DvqWAcx7FHBiVlioCxa9o3s2Di7DtimucOXtlSh4LTyZq/qoQbOzkeXO7/0unghQ7pjMzNB1Xr/SNB2tIRVcTdEqpy74fYJ6cocilX8Eb2i3AuEpiYlPtpqujGq/1uutyvPCEGIJu28WT9i75GrAom6etZ++VpuHWw33I16MzKdxOjLZ4w5gHdhiybBfRenF2XXPqcEFMH78okk/Jmk3sUsueppieYz3jgjrXyqIfg9Ayqy89/lJW/B6sm5q5nbX2TzhmeI0bxRl02j2TOwPVJjgx3ySJevStEV8SJEFazuggWRFjbW7A/0TAbGRgBtDu378rLxwiqWCnedkKFuSJVEYLWb1rkRnymb8kWHRFZM+wi+cmaWTdNz+u8VvAwUxUAxlfQaLYamguJbJD+MZZzRhLNIHMJm1DcnJdECI6P3rtd6d6YJI2+TdyXRb8bNg+obsU+ppH+yxLw4NlWFbvXREBZB6trXaIf3fhI+f4FbA2+lb5IJ5euHGu5FabDFvABadac+bVMBFsmLTQEKOGWnEyX038mvTSpS5MLw+NfCXIlMW94wwokBZ/0I0mEhPAflB+p9xZVJUHd3qYbTnMs=", "ServerCertificate": "MIIE9DCCAtygAwIBAgIQAJq3Mj8c1rXwra3rDC0BgzANBgkqhkiG9w0BAQ0FADAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMCAXDTI0MTIwNDA5Mzc1OFoYDzk5OTkxMjMxMjM1OTU5WjAbMRkwFwYDVQQDDBBRdWFzYXIgU2VydmVyIENBMIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAgDdz73u2oR4NOea2y1Gy+ejcDZB7rD3j8AcyTdfqU60MW8K4UCvWDATRHvg0Q+WxaHgJjvGGAOzSgmLJF/sKanAHM+Ejhya1aOTADACluOYW9YcZ4hhpmvAgq9IZKr3VXAH6AlDVb6EYlFvNUzQMRbMzZflnnYPpoKtj96/xEllcqnYYe5iiIF25objFBsOivILrD8r5zzl30bfwt6bcs7EZ77qOOajuTqF5VPneX/C1mgSqnK1KeE4MyI6vfJvaWAQ7sjNLWflauxXUMALmiEssTwcfJ1+GOhoXngcZ6TzTQqdzBGbaEmgWvsIvZSgGu/ddDnX01P26IKwLVHCFRdDY82m3FXkPv/WpK+P95yeUA3uzIIZlbFPXr+8pdylqs/E5+b7LNIAxQRhXI4NfwAhUfLq4MhYlLh844vRdBda+7g19pW6rrU+R5BObTIE5pry54Stz+rgS9I81k7Kaqzq2MbOMYoHBSQkfH/whUILDnSvm+J/7nAm1kYbamCUZQY27NYhcHWmBEBEwSDe4K2MlHzn2nEXY7H1GRTvdCtUnHoLbGGue4J64dnTA1mL4XYWgmKjNWUcemFuo3lkQD+M3GkW5nTPlEkP6X116nlzIH1tm3fp2PRQphJvowVrcA/Ch6Me4VYt7vEV4gUPn9o+tqu2QDvFBjS+iFx8YYXcCAwEAAaMyMDAwHQYDVR0OBBYEFM0CBviNX3UM6cXNdgOhJ1Q8+Tu5MA8GA1UdEwEB/wQFMAMBAf8wDQYJKoZIhvcNAQENBQADggIBABtf3WU07+re45SWDknjH/SP021fFZEXLh9u7mE/zGyJw2C3vhs9+47GhCp6jNjZg7NntWJboiyj4VhNHRuLnqItAPF60JGo3Q3TuSRDdCcDg/9DSdbODMg2EcH/kk1yVQgE6+qDC7H+SbNn6JgTnFTH1KesnSHl/m/Y3Bg2+ZTiJuDwxBXsAfRjSuhjaMe/k2oCWE5PngTtcSSOLbhMQ7kAZMl3++MSFe3Q8vUnpyKq5gELt1RnACtyPInqCM2gXA1rRw407+6AoyjnUo5M5/jwYIicQEJVkkJSSO7opyR1t9SNh8nrjxEtJIgsitQRrGh0vJLQYeTJDCy4RGwR8o7sruyrJcfHZjX3D1QujdUl1C6mSTR9E/LW2pEq4EkaifcG4WOejyIsspkrCDSeyWyRXjMxq4FlVGgtbzVZbIQbPOpSbDMNIHr4QKgsp0Xa/cgb830U6g5TFUNX2C7ueZrDpV0nAvOUsm2OQ9SBPLSgds4hESjjSxh2I2/WwYJl1TB642zOPUPfOuYN2xvBm9D0sZWMZe7l8ou899vN3zogGQwX1wJTyVorX/IgpNljOZDNVYSL7YEAiQI6YM03H1pkjY9EgeboVCIpWbRBvx0bjk1GRHpRM2Hst3mDU7F7AOepmS8xBatuBKRIEHWJ00a55Pb6d7CoySAxY7aN0FT7"}

Yara detected Quasar RAT

Source: Yara match	File source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1927009729.0000000000420000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3103987388.0000000002841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3103987388.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.2% probability

Source: lz3EbiqoK4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe

Window detected: Accept - next Welcome to TeamViewerRemote Support unattended access meetings and presentationsLicense Agreement: By continuing you agree to the terms of the license agreement.License Agreement:Default installationInstall and set up unattended access to this deviceRun only (one time use)Show advanced settingsHow do you want to proceed?

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfiles.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfilesx64.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TV15Install.log			Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log			Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source:	Binary string: E:\WS\DriverBuild\Drivers\Win\VirtualMonitor\bin\x64\Release\TVVirtualMonitorDriver.pdb source: TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64dll.pdb source: TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb{ source: TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\teamviewer_2\Installer\plugins\TvGetVersion\Release_Unicode\TvGetVersion.pdb source: TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb source: TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\RemotePrintingDriver\Win\XPSDriverFilter\Build\XPSFilter\x64\Release\TeamViewer_XPSDriverFilter.pdb source: TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\teamviewer_2\Installer\plugins\TvGetVersion\Release\TvGetVersion.pdb source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\Win\DeviceRedirection\bin\x64\Release\TeamViewer_VirtualDeviceDriver.pdb source: TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\teamviewer_tvmonitordriver\drivers\win\monitor\objfre_win7_amd64\amd64\TVMonitor.pdb source: TeamViewer_.exe, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\openvpn-2.1_rc4\tap-win32\amd64\teamviewervpn.pdb source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Documents\Programming\OpenSourceProjects\tap-windows6\src\x64\Hlk\teamviewervpn.pdb source: TeamViewer_.exe, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00405FFD FindFirstFileA,FindClose,	5_2_00405FFD
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	5_2_0040559B
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00402688 FindFirstFileA,	5_2_00402688
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040596F
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_004064C1 FindFirstFileW,FindClose,	6_2_004064C1
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_004027FB FindFirstFileW,	6_2_004027FB
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	9_2_0040596F
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004064C1 FindFirstFileW,FindClose,	9_2_004064C1
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004027FB FindFirstFileW,	9_2_004027FB

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Networking

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: 167.71.56.116

Yara detected Generic Downloader

Source: Yara match	File source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

Source: global traffic

TCP traffic: 192.168.2.4:49732 -> 167.71.56.116:22269

Source: Joe Sandbox View

IP Address: 167.71.56.116 167.71.56.116

Source: Joe Sandbox View

ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS

Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116
Source: unknown	TCP traffic detected without corresponding DNS query: 167.71.56.116

Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0E
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertHighAssuranceEVRootCA.crt0K
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crt0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crt0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://cacerts.digicert.com/DigiCertTrustedRootG4.crt0C
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://client.teamviewer.com/shutdown/index.aspx?lng=en
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://connect.teamviewer.com/v15Hhttp://www.teamviewer.com/download/version_15x/TeamViewer_Host_Set
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl.thawte.com/ThawteTimestampingCA.crl0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertHighAssuranceEVRootCA.crl0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0S
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedG4RSA4096SHA256TimeStampingCA.crl0
Source: TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl3.digicert.com/DigiCertTrustedRootG4.crl0
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://crl4.digicert.com/DigiCertTrustedG4CodeSigningRSA4096SHA3842021CA1.crl0
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://github.com/jquery/jqueryui.com
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jquery.com/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://jquery.org/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://knockoutjs.com/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://mozilla.org/MPL/2.0/.
Source: TeamViewer_Setup_x64.exe, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000000.2001772161.0000000000409000.00000008.00000001.01000000.00000009.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000000.2001772161.0000000000409000.00000008.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmp, TeamViewer_.exe, 00000006.00000000.2030978743.000000000040A000.00000008.00000001.01000000.0000000C.sdmp, TeamViewer_.exe, 00000009.00000000.2118967141.000000000040A000.00000008.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0A
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0C
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0I
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.digicert.com0O
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://ocsp.digicert.com0X
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ocsp.thawte.com0
Source: Client-built.exe, 00000001.00000002.3103987388.0000000002841000.00000004.00000800.00020000.00000000.sdmp, Client-built.exe, 00000001.00000002.3103987388.00000000029C5000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://scripts.sil.org/OFL
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crl0a
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcb.com/sf.crt0
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://sf.symcd.com0&
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://tanyabrassie.com/
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-aia.ws.symantec.com/tss-ca-g2.cer0
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-crl.ws.symantec.com/tss-ca-g2.crl0(
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ts-ocsp.ws.symantec.com07
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.boost.org/users/license.html).
Source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.digicert.com/CPS0
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/)
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2396253826.0000000007180000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2402736090.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/download/version_15x/TeamViewerQJ.exe
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/download/version_15x/TeamViewer_Setup.exe
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/favicon.ico
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=103286
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=130291
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=141508
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=144319
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=148325
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=181342
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=190014
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=233248
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2326608645.0000000001402000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=271351
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=271351#Th
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=271351$Pridae
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=271351&Adicionar
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=301635
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=301635#
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635$
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635F
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635POm
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635SAko
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635TAk
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635_
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635aDac
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635c
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635g
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=301635lSe
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=301635sN
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=308980
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=362946
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=364893
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=413309
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=441415
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=456463
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=456463#~b
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=456463OKh
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463YD
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463mScript-urile
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463mSkript
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463p
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463qSkripte
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463r
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=456463xScripts
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=475051
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=517756
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=522447
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=526914
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=539523
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=539523%
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=539523)
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=539523)Installation
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=5395230Configura
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=5395239
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=539523?
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=563890
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=591924
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=613217
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=632515
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=632515.
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=632515/Op
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=6325150Alternativ
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=6325150TeamViewer
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=6325155
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=6325156Ca
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=6325157
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=632515:Opc
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=633113
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=649250
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=649250M
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=649250U
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=649250f
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=649250y
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=659842
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=666256
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=696517
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=696517$E-Mail
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=703800
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=720679
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679aInloggningen
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679aLogin
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679gPrihl
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679hPrijavljivanje
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=720679n
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679p
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679t
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679yLog
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=720679yOturum
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=740465
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=801210
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210#
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210Q
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210YFj
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210c
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210eO
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210gVo
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=801210jMa
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210jUdaljeni
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210kUzak
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=801210xComputerul
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=861823
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=861823?
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823NDu
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823P
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823Q
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823R
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823SOtomatik
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823XTrebuie
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=861823gAby
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=866109
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=874259
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=891850
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=891850&Bezpe
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=891850)
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=891850/O
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=8918502Codul
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=8918503Sigurnosna
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=899369
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=907878
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=922587
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=934954
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=9349542Sua
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=9349547
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954=
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954=Tiden
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954=Zahtev
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=934954F
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954J
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=934954MSolicitarea
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=942683
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=954698
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=964412
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: http://www.teamviewer.com/link/?url=999999
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=999999tS
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=999999wFil
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.teamviewer.com/link/?url=999999~
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://%1%.teamviewer.com/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://%1%.teamviewer.com/%2%
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%1%.teamviewer.com/%2%)Introducec
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://%1%.teamviewer.com/0
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%1%.teamviewer.com/5
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://%1%.teamviewer.com/z
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000009303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://account.teamviewer.
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/fabric-assets-license
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://aka.ms/fluentui-assets-license
Source: Client-built.exe, 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://api.ipify.org/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://chromium.googlesource.com/chromium/src/third_party/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://cla.developers.google.com/clas
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://client.teamviewer.com/blizzintro/?language=%1%&os=%2%&client=%3%
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://client.teamviewer.com/intro/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%DSorry.
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://client.teamviewer.com/whatsnew/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%&insiderbuild=%5
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://community.teamviewer.com/kb/articles/106782-managed-devices-general-information
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/kb/articles/106782-managed-devices-general-information(Zobrazovae
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/kb/articles/106782-managed-devices-general-information3
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz$Radnja
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz)Platnose
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz0Tidsgr
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz2Acc
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz30
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz3Thao
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz6
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by-sa/4.0/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://creativecommons.org/licenses/by/4.0/)
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/cps0%
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://d.symcb.com/rpa0
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://dev-trunk.teamviewer.com/CommentSession/CommentAfterSession?token=%1%&lng=%2%&version=%3%&os
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: https://dev-trunk.teamviewer.com/CommentSession/CommentDuringSession?token=%1%&lng=%2%&version=%3%&o
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://feedbackservice-test.teamviewer.com
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://feedbackservice.teamviewer.com
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://feedbackservice.teamviewer.com/upload/index8https://feedbackservice-test.teamviewer.com/uplo
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://fontawesome.com/license/free.
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://get.teamviewer.com/v15/%1%vYou
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://get.teamviewer.com/v15/%2%
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://getassistar.teamviewer.com/%1%
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://getassistar.teamviewer.com/%1%C%1%
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getassistar.teamviewer.com/%1%K%1%
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://getassistar.teamviewer.com/%2%
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://getassistar.teamviewer.com/%2%8
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://getassistar.teamviewer.com/%2%9
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://git.coolaj86.com/coolaj86/atob.js.git
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/101arrowz/fflate
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/DefinitelyTyped/DefinitelyTyped
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/FortAwesome/Font-Awesome
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/FortAwesome/react-fontawesome
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/JedWatson/classnames
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/MrRio/jsPDF
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Popmotion/hey-listen
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Popmotion/popmotion
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Qix-/color-convert
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raynos/duplexer
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/Raynos/function-bind
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/RebeccaStevens/deepmerge-ts
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ReneNyffenegger/cpp-base64
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/SamVerschueren/decode-uri-component
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/SergiusTheBest/exceptxx
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ShiqiYu/libfacedetection
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/adobe/react-spectrum
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/alexindigo/asynckit
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/axios/axios
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/babel/babel
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/benjamn/reify
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/boostorg/boost
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/browserslist/browserslist
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/browserslist/caniuse-lite
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/canvg/canvg
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/caolan/async
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-regex
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/ansi-styles
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chalk/chalk
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/chartjs/Chart.js
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/colorjs/color-name
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/component/escape-html
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/cure53/DOMPurify
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/curl/curl
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/date-fns/date-fns
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/emotion-js/emotion/tree/main/packages/hash
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/emotion-js/emotion/tree/master/packages/is-prop-valid
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/emotion-js/emotion/tree/master/packages/memoize
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/epoberezkin/fast-deep-equal
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ericf/css-mediaquery
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/farzher/fuzzysort
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/felixge/node-combined-stream
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/felixge/node-delayed-stream
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/fengyuanchen/cropperjs
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/follow-redirects/follow-redirects
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/form-data/form-data
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/framer/motion
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/frenic/csstype
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/glennrp/libpng
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/boringssl/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/google/farmhash
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/googlefonts/dm-fonts/tree/main/Sans
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/henrikjoreteg/html-parse-stringify
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/i18next/i18next
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/i18next/i18next-browser-languageDetector
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/i18next/i18next-http-backend
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/i18next/i18next-resources-to-backend
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/immerjs/immer
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/infusion/Fraction.js
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/functions-have-names
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/has-property-descriptors
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/has-symbols
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/has-tostringtag
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/is-arguments
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/is-date-object
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/inspect-js/is-regex
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/fs.realpath
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/inherits
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/isaacs/node-glob
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jakejs/jake
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jaredLunde/react-hook
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jhchen/fast-diff
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquense/react-common-hooks
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquery-validation/jquery-validation
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquery/jquery
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jquery/jqueryui.com
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/jshttp/cookie
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/juggle/resize-observer
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/juliangruber/balanced-match
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/juliangruber/brace-expansion
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/justmoon/node-extend
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/kilian/electron-to-chromium
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/knockout/knockout
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/libjpeg-turbo/libjpeg-turbo
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/libuv/libuv/tree/master/src
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/call-bind
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/define-properties
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/ljharb/get-intrinsic
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lquixada/cross-fetch
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukeed/clsx
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukeed/dequal
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lukeed/escalade
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/lydell/js-tokens
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mantinedev/mantine
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mathiasbynens/emoji-regex
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mde/ejs
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mde/filelist
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/fluentui
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/fluentui-system-icons
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/griffel
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/microsoft/rushstack
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/missive/emoji-mart
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mit-plv/fiat-crypto/blob/master/AUTHORS).
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/mridgway/hoist-non-react-statics
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/niklasvh/base64-arraybuffer
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/niklasvh/css-line-break
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/niklasvh/html2canvas
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/nolimits4web/dom7
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/npm/inflight
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/open-cli-tools/concurrently
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/open-source-parsers/jsoncpp
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/popperjs/popper-core
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/postcss/autoprefixer
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pradel/esbuild-node-externals
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/primus/eventemitter3
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/pvorb/node-clone
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/reach/observe-rect
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-bootstrap/dom-helpers
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-dropzone/attr-accept
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-dropzone/file-selector
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-native-async-storage/async-storage
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/react-restart/ui
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/reduxjs/redux-toolkit
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/remix-run/react-router
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rexxars/hyphenate-style-name
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/rochal/jQuery-slimScroll
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/simonbengtsson/jsPDF-AutoTable
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/simonbengtsson/jspdf-autotable
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/filter-obj
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/find-up
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/gzip-size
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/has-flag
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/is-docker
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/is-fullwidth-code-point
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/is-plain-obj
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/is-wsl
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/sindresorhus/query-string
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/standard-things/esm
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/stefanpenner/get-caller-file
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/substack/node-deep-equal
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/suren-atoyan/monaco-loader
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/suren-atoyan/monaco-react
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/swc-project/swc
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tanstack/react-virtual
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tanstack/table
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/tarruda/has
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/thlorenz/convert-source-map
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/twbs/bootstrap
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/weidai11/cryptopp
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wojtekmaj/date-utils
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/wojtekmaj/get-user-locale
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/yargs/cliui
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zertosh/invariant
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://github.com/zloirock/core-js
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://go.teamviewer.com/v15
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://go.teamviewer.com/v15/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://go.teamviewer.com/v15b
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://go.teamviewer.com/v15c
Source: Client-built.exe, 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://ipwho.is/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://kossnocorp.mit-license.org
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://login.teamviewer.com/nav/license-activation-guidance
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://mathiasbynens.be/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://meeting.teamviewer.com/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr	String found in binary or memory: https://meeting.teamviewer.com/._Please
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://meeting.teamviewer.com/join/-https://www.teamviewer.com/meeting/telephone/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://meeting.teamviewer.com/join/-https://www.teamviewer.com/meeting/telephone/Y
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://meeting.teamviewer.com/join/-https://www.teamviewer.com/meeting/telephone/Z:N
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://npm.runkit.com/concat-map
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nsis.sourceforge.io/Base64_plug-in
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nsis.sourceforge.io/DialogsEx_plug-in
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://nsis.sourceforge.io/Invoke_Shell_Verb_plugin
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://opensource.org/licenses/MIT)
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://opensource.org/licenses/Zlib)
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://quicksupport.me/s%1%
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://scripts.sil.org/OFL)
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://sindresorhus.com)
Source: Client-built.exe, 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://stackoverflow.com/q/11564914/23354;
Source: Client-built.exe, 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp, Client-built.exe, 00000001.00000002.3103987388.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, Client-built.exe, 00000001.00000002.3103987388.0000000002881000.00000004.00000800.00020000.00000000.sdmp	String found in binary or memory: https://stackoverflow.com/q/14436606/23354
Source: Client-built.exe, 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp	String found in binary or memory: https://stackoverflow.com/q/2152978/23354sCannot
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://webrtc.googlesource.com/src/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.apache.org/licenses/LICENSE-2.0
Source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.digicert.com/CPS0
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.npmjs.com/package/
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.npmjs.com/package/btoa
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.cn/cn/lo-assist-ar/YUsers
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000009303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.co
Source: TeamViewer_.exe, 00000006.00000002.2462334594.0000000002773000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2326608645.0000000001402000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/en/gdpr/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/en/gdpr/#
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/en/gdpr/)
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/en/lo-assist-ar/YUsers
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000009303000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=116574
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=125377
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=165388
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=165388#Tyv
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=1653880R
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=1653883Ne
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=1653885=
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=1653888
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=180010
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=261802
Source: TeamViewer_.exe, 00000006.00000002.2462334594.0000000002773000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2326608645.0000000001402000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=271878Hinweis
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=279064$(WK
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=279064NKh
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064UY
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064VScripts
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064YSkript
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064ZD
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064b
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064lScript-urile
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064oSkripte
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=279064rOs
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=290947
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=290947#
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=290947$
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=290947%Dezactiva
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=290947%Donan1
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=293922
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=300792
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=364272
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=364272&
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=364272)Naozaj
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=3642722Doric
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=3642724Da
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=3642728Ba#
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=3642728Devam
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=378443
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=382377
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377dPristajem
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377g/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377lAutorizo
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377lJag
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=382377nT
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377p/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377sS
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377tConsimt
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=382377wKi_
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=418720
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=461825ZYour
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=462409
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=462409IMQ
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=462409JMQ9
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=514937
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=572005
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=572005S
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=572005T
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=601593
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=601593C
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=737863
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=773631
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=780538
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=790045
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=7900459/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=790045s/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=850268&utm_source=mainwindow&utm_medium=client&utm_content=wind
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=879333
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=879333~Tento
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=881911
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/link/?url=940942
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/link/?url=9409420Experimente
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/meeting
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/meeting/telephone/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/ru/lo-assist-ar/YUsers
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/teamviewer-tensor/single-sign-on/
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/teamviewer-tensor/single-sign-on/1
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.teamviewer.com/teamviewer-tensor/single-sign-on/6
Source: TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	String found in binary or memory: https://www.teamviewer.com/ticket
Source: TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.yworks.com/

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Code function: 5_2_00405050 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

5_2_00405050

E-Banking Fraud

Yara detected Quasar RAT

Source: Yara match	File source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1927009729.0000000000420000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3103987388.0000000002841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3103987388.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen
Source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: Detects Quasar infostealer Author: ditekshen
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED	Matched rule: Detects QuasarRAT malware Author: Florian Roth
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED	Matched rule: Detects executables containing common artifcats observed in infostealers Author: ditekSHen

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	5_2_004030D9
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	6_2_004033B6
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	9_2_004033B6

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	File created: C:\Windows\assembly\Desktop.ini			Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Caches			Jump to behavior

Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe

File deleted: C:\Windows\Temp\nss812C.tmp

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B7311D3	1_2_00007FFD9B7311D3
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B7310F2	1_2_00007FFD9B7310F2
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B7310D1	1_2_00007FFD9B7310D1
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B995BE1	1_2_00007FFD9B995BE1
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B994DC6	1_2_00007FFD9B994DC6
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B9993C1	1_2_00007FFD9B9993C1
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B99A7CD	1_2_00007FFD9B99A7CD
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B998A61	1_2_00007FFD9B998A61
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B9911F2	1_2_00007FFD9B9911F2
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B9910D1	1_2_00007FFD9B9910D1
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00406344	5_2_00406344
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_0040488F	5_2_0040488F
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_00406846	6_2_00406846
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_00404C59	6_2_00404C59
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_00406846	9_2_00406846
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_00404C59	9_2_00404C59

Source: TeamViewer_Resource_ar.dll.6.dr	Static PE information: Resource name: RT_STRING type: PDP-11 separate I&D executable not stripped
Source: TeamViewer_Resource_cs.dll.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_de.dll.6.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE ECOFF executable not stripped - version 0.101
Source: TeamViewer_Resource_el.dll.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_es.dll.6.dr	Static PE information: Resource name: RT_STRING type: MIPSEB-LE MIPS-II ECOFF executable not stripped - version 0.100
Source: TeamViewer_Resource_it.dll.6.dr	Static PE information: Resource name: RT_STRING type: 370 XA sysV executable not stripped
Source: TeamViewer_Resource_it.dll.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_nl.dll.6.dr	Static PE information: Resource name: RT_STRING type: DOS executable (COM, 0x8C-variant)
Source: TeamViewer_Resource_ru.dll.6.dr	Static PE information: Resource name: RT_STRING type: x86 executable not stripped

Source: TeamViewer_Desktop.exe.6.dr	Static PE information: Number of sections : 13 > 10
Source: TeamViewer.exe.6.dr	Static PE information: Number of sections : 12 > 10

Source: TeamViewer_Resource_ja.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_cs.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_it.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_hu.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_pt.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_hr.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_ar.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_ru.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_ko.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_lt.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_en.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_nl.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_he.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_pl.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_ro.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_fr.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_fi.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_es.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_id.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_el.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_bg.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_no.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_da.dll.6.dr	Static PE information: No import functions for PE file found
Source: TeamViewer_Resource_de.dll.6.dr	Static PE information: No import functions for PE file found

Source: lz3EbiqoK4.exe, 00000000.00000002.2002453823.0000000004C2A000.00000004.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameVenomless.exe0 vs lz3EbiqoK4.exe
Source: lz3EbiqoK4.exe, 00000000.00000002.2006449760.0000000004E3E000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenamemscorwks.dllT vs lz3EbiqoK4.exe

Source: lz3EbiqoK4.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE

Source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers
Source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_QuasarStealer author = ditekshen, description = Detects Quasar infostealer, clamav_sig = MALWARE.Win.Trojan.QuasarStealer
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED	Matched rule: MAL_QuasarRAT_May19_1 date = 2019-05-27, hash1 = 0644e561225ab696a97ba9a77583dcaab4c26ef0379078c65f9ade684406eded, author = Florian Roth, description = Detects QuasarRAT malware, reference = https://blog.ensilo.com/uncovering-new-activity-by-apt10
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED	Matched rule: INDICATOR_SUSPICIOUS_GENInfoStealer author = ditekSHen, description = Detects executables containing common artifcats observed in infostealers

Source: classification engine

Classification label: mal88.troj.evad.winEXE@17/107@0/1

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_04E0AA8E AdjustTokenPrivileges,	0_2_04E0AA8E
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Code function: 0_2_04E0AA57 AdjustTokenPrivileges,	0_2_04E0AA57
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_004030D9 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,ExitProcess,CoUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	5_2_004030D9
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	6_2_004033B6
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,ExitProcess,CoUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,	9_2_004033B6

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Code function: 5_2_0040431C GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

5_2_0040431C

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Code function: 5_2_0040205E CoCreateInstance,MultiByteToWideChar,

5_2_0040205E

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe

File created: C:\Program Files\TeamViewer

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\lz3EbiqoK4.exe.log

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Mutant created: NULL
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Mutant created: \Sessions\1\BaseNamedObjects\TeamViewer_Win32_Instance_Mutex
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2872:120:WilError_03
Source: C:\Windows\System32\conhost.exe	Mutant created: \BaseNamedObjects\Local\SM0:8104:120:WilError_03
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\3470ac31-30aa-4cf6-ab0a-1ed0dd64656f
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7920:120:WilError_03

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File created: C:\Users\user\AppData\Local\Temp\Client-built.exe

Jump to behavior

Source: lz3EbiqoK4.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.%s VALUES('index',%Q,%Q,#%d,%Q);
Source: TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.%s SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqlite_autoindex%%' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');

Source: unknown	Process created: C:\Users\user\Desktop\lz3EbiqoK4.exe "C:\Users\user\Desktop\lz3EbiqoK4.exe"
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\Client-built.exe "C:\Users\user\AppData\Local\Temp\Client-built.exe"
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe"
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Process created: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe"
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: unknown	Process created: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Source: C:\Windows\SysWOW64\schtasks.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\Client-built.exe "C:\Users\user\AppData\Local\Temp\Client-built.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Process created: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F	Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: mrmcorer.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: thumbcache.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: riched20.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: usp10.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msls31.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: secur32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: wtsapi32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: dwmapi.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: oleacc.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: shfolder.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File written: C:\Windows\assembly\Desktop.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Microsoft\Office\24.0\Outlook

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfiles.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.ico	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\utils	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfilesx64.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Directory created: C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log	Jump to behavior

Source: lz3EbiqoK4.exe

Static file information: File size 75655168 > 1048576

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9672_none_d08f9da24428a513\MSVCR80.dll

Jump to behavior

Source: lz3EbiqoK4.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x4804800

Source: lz3EbiqoK4.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: E:\WS\DriverBuild\Drivers\Win\VirtualMonitor\bin\x64\Release\TVVirtualMonitorDriver.pdb source: TeamViewer_.exe, 00000006.00000003.2399208494.00000000070A0000.00000004.00001000.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: E:\WS\tv_prel_dcr\build_cmake_win_HOOKS\Release\tv_x64dll.pdb source: TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb{ source: TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\teamviewer_2\Installer\plugins\TvGetVersion\Release_Unicode\TvGetVersion.pdb source: TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\TVWorkspace\teamviewer\Installer\plugins\CustomerData\Release_Unicode\CustomerTools.pdb source: TeamViewer_.exe, 00000009.00000002.2327257461.000000000166F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\RemotePrintingDriver\Win\XPSDriverFilter\Build\XPSFilter\x64\Release\TeamViewer_XPSDriverFilter.pdb source: TeamViewer_.exe, 00000006.00000003.2402427129.0000000008BBD000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2403908650.00000000090D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: D:\Sources\teamviewer_2\Installer\plugins\TvGetVersion\Release\TvGetVersion.pdb source: TeamViewer_Setup_x64.exe, 00000005.00000002.2467968042.00000000027A5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\WS\DriverBuild\Drivers\Win\DeviceRedirection\bin\x64\Release\TeamViewer_VirtualDeviceDriver.pdb source: TeamViewer_.exe, 00000006.00000003.2399085849.0000000008BBC000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_.exe, 00000006.00000003.2399365460.00000000090D0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: c:\teamviewer_tvmonitordriver\drivers\win\monitor\objfre_win7_amd64\amd64\TVMonitor.pdb source: TeamViewer_.exe, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: c:\openvpn-2.1_rc4\tap-win32\amd64\teamviewervpn.pdb source: TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: D:\Documents\Programming\OpenSourceProjects\tap-windows6\src\x64\Hlk\teamviewervpn.pdb source: TeamViewer_.exe, TeamViewer_.exe, 00000006.00000003.2398048520.000000000867E000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

.NET source code contains potential unpacker

Source: TeamViewerMeetingAddIn.dll.6.dr, --qdiar3fpxMdE_O-uKtiZaHzM76uqX9zY5hvhR03efmZo-.cs

.Net Code: _0023_003DqBpJGytwcRfv3VgHjfwTrsA_003D_003D

Source: tv_x64.dll.6.dr	Static PE information: section name: _RDATA
Source: tv_x64.dll.6.dr	Static PE information: section name: .shared
Source: TeamViewer_XPSDriverFilter.dll.6.dr	Static PE information: section name: _RDATA
Source: crashpad_handler.exe.6.dr	Static PE information: section name: _RDATA
Source: crashpad_handler.exe.6.dr	Static PE information: section name: CPADinfo
Source: MicrosoftEdgeWebview2Setup.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer.exe.6.dr	Static PE information: section name: IPPCODE
Source: TeamViewer.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer.exe.6.dr	Static PE information: section name: .rodata
Source: TeamViewer.exe.6.dr	Static PE information: section name: IPPDATA
Source: TeamViewer.exe.6.dr	Static PE information: section name: _RDATA
Source: TeamViewer.exe.6.dr	Static PE information: section name: CPADinfo
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: .orpc
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: IPPCODE
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: .rodata
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: IPPDATA
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: _RDATA
Source: TeamViewer_Desktop.exe.6.dr	Static PE information: section name: CPADinfo
Source: TeamViewer_Note.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer_Note.exe.6.dr	Static PE information: section name: _RDATA
Source: TeamViewer_Service.exe.6.dr	Static PE information: section name: IPPCODE
Source: TeamViewer_Service.exe.6.dr	Static PE information: section name: .didat
Source: TeamViewer_Service.exe.6.dr	Static PE information: section name: IPPDATA
Source: TeamViewer_Service.exe.6.dr	Static PE information: section name: _RDATA
Source: tv_w32.exe.6.dr	Static PE information: section name: .didat
Source: tv_x64.exe.6.dr	Static PE information: section name: .didat
Source: tv_x64.exe.6.dr	Static PE information: section name: _RDATA
Source: WriteDump.exe.6.dr	Static PE information: section name: _RDATA
Source: TeamViewerMeetingAddinShim64.dll.6.dr	Static PE information: section name: _RDATA

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B728163 push ebx; ret	1_2_00007FFD9B72816A
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B727569 push ebx; iretd	1_2_00007FFD9B72756A
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Code function: 1_2_00007FFD9B992A42 push eax; ret	1_2_00007FFD9B992BFC
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_3_0867F750 push edi; iretd	6_3_0867F751

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nsfB965.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\UAC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	File created: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nsfB965.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	File created: C:\Users\user\AppData\Local\Temp\Client-built.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\linker.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to dropped file
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	File created: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	File created: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\TvGetVersion.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nsfB965.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\TvGetVersion.dll	Jump to dropped file

Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nsfB965.tmp\nsExec.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nsfB965.tmp\System.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Windows\Temp\nsfB965.tmp\nsArray.dll	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to dropped file

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	File created: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TV15Install.log			Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	File created: C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log			Jump to behavior

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe

Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F

Hooking and other Techniques for Hiding and Protection

Hides that the sample has been downloaded from the Internet (zone.identifier)

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe

File opened: C:\Users\user\AppData\Local\Temp\Client-built.exe:Zone.Identifier read attributes | delete

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\conhost.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 6970000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 120C0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 1BAA0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 25160000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 29FF0000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Memory allocated: 3FD10000 memory commit \| memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Memory allocated: B60000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Memory allocated: 1A840000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Dropped PE file which has not been started: C:\Windows\Temp\nsfB965.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\UAC.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Dropped PE file which has not been started: C:\Windows\Temp\nsfB965.tmp\nsExec.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsArray.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\UserInfo.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\InstallOptions.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\linker.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsis7z.dll	Jump to dropped file
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Dropped PE file which has not been started: C:\Windows\Temp\nsfB965.tmp\System.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	Jump to dropped file
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Dropped PE file which has not been started: C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	Jump to dropped file

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe TID: 7424

Thread sleep time: -922337203685477s >= -30000s

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe

File Volume queried: C:\ FullSizeInformation

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00405FFD FindFirstFileA,FindClose,	5_2_00405FFD
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_0040559B GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,	5_2_0040559B
Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	Code function: 5_2_00402688 FindFirstFileA,	5_2_00402688
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	6_2_0040596F
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_004064C1 FindFirstFileW,FindClose,	6_2_004064C1
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Code function: 6_2_004027FB FindFirstFileW,	6_2_004027FB
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose,	9_2_0040596F
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004064C1 FindFirstFileW,FindClose,	9_2_004064C1
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Code function: 9_2_004027FB FindFirstFileW,	9_2_004027FB

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\Documents\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData\Local\Temp	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\Desktop\desktop.ini	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	File opened: C:\Users\user\AppData\Local	Jump to behavior

Source: lz3EbiqoK4.exe, 00000000.00000002.2006449760.0000000004ED3000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: Client-built.exe, 00000001.00000002.3132329467.000000001B270000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllGt3c
Source: Client-built.exe, 00000001.00000002.3100088074.0000000000A10000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: r&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe	API call chain: ExitProcess graph end node	graph_5-3278
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	API call chain: ExitProcess graph end node	graph_6-3624
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	API call chain: ExitProcess graph end node	graph_9-3561

Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Process token adjusted: Debug			Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Memory allocated: page read and write | page guard

Jump to behavior

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\Client-built.exe "C:\Users\user\AppData\Local\Temp\Client-built.exe"	Jump to behavior
Source: C:\Users\user\Desktop\lz3EbiqoK4.exe	Process created: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F	Jump to behavior
Source: C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F	Jump to behavior

Source: TeamViewer_.exe, 00000006.00000003.2396473241.000000000D100000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: SharedMem_SetLogLevel: %u -> %u***** assertion failed: 'release', line %i, err %i*** assertion failed: 'setev', line %i, err %i*** assertion failed: '(type == State_x64) \|\| (type == State_w32)', line %i, err %iSetDirectXHookStatus %u -> %uStarting Single Window*** assertion failed: 'hwnd', line %i, err %iStopping Single Window*** assertion failed: 'unhooksc', line %i, err %iStarting Update HookProgmanSHELLDLL_DefViewSysListView32Stopping Update Hook*** assertion failed: 'hdc', line %i, err %i*** assertion failed: 'ctos1 && ctos2', line %i, err %i***** assertion failed: 'wrect', line %i, err %i
Source: TeamViewer.exe.6.dr	Binary or memory string: BlizzMeetingShareScreenPopupBlizzMeetingShareScreenPopup::DrawScreenRow: Expected 1-3 screen in row, but got %1%.msctls_trackbar32BlizzMeetingShowMorePopupCameraOptionsPopupPanelWindowParticipantListPanelMixedParticipantsPanelMixedParticipantsPanel::OnCreate: MixedParticipants panel creation failed!MixedParticipantsPanel::OnCreate(): Video participants could not be initialized!MixedParticipantsPanel::OnCreate(): Audio participants could not be initialized!AudioParticipantsPanelVideoParticipantsPanelParticipantsTabContainerAddParticipantPopup::Factory: Missing dependenciesCenterNotificationsViewController::Factory:: Missing dependenciesBlizzMeetingCommandBarBlizzMeetingCommandBar::RefreshTaskBarHandles: Fetching task bar handles failed with error %1%BlizzMeetingCommandBar::Close. Failed to close window. Error %1%BlizzMeetingCommandBar::OnCameraOptions: MissingfactoryShell_SecondaryTrayWndShell_TrayWndInstantSupportWaitingRoomView::InitBkgndUnscaled: no logo file (or loading failed)TVInstantSupportWaitingRoomViewBlizzMeetingRequestScreenSharingPopupBlizzRemoteScreenPanel::OnRemoteScreenAdded: Invalid view modelBlizzRemoteScreenPanel::OnRemoteScreenAdded: Failed to create remote screen viewBlizzRemoteScreenPanelBlizzSplitterWindowImplBlizzParticipantViewContainer::Close. Failed to close window. Error %1%. Retry in %2%ms.BlizzParticipantViewContainer
Source: TeamViewer.exe.6.dr	Binary or memory string: tvviewmodels::SessionReportingSaveDialogViewModel::GetSaveDialogText%1% Wrong dialog text ID: %2%ShortRemoteInfo.Stream.IncompleteShortRemoteInfo.Stream.Inconsistent</break></end></item><item></value><value></category><category></remote><remote>VPNViewModel::Factory: Failed to create an instancesession-recording-initiatedSessionRecordingToolbarViewModel::Factory: failed to create an instance.RemotePrintingToolbarViewModel::Factory: failed to create an instanceRemoteUpdateToolbarViewModel::Factory: failed to create an instanceVirtualMonitorNotification. Install driver response not availableVirtualMonitorNotification is unknowntvviewmodels::ClientToolbarViewModel::Init::<lambda_1>::operator ()VirtualMonitorNotification is %1%ClientToolbarViewModel::Factory: not all required parameters are set.ClientToolbarViewModel::ConvertToViewModelType:: unknown state [%1%]show-monitors-in-one-screenmonitor-switchedshow-monitor-ClientToolbarViewModel::GetDevModes(): quanitity of screen relosutions: %1%via-submenufull-screen-leftfull-screen-activatedvia-toolbarsession-handover-initiatedendsessionandlockDashboard-ShownVirtualMonitorNotification. Timeout errorVirtualMonitorNotification. General error%1%: uiModel is nullRemoteScreenDragAndDropViewModel::FactoryQuickStepsViewModel::OnAvailableRemoteActionsChanged: display element for action %1% not found!AutomaticMonitorActivation::GetMonitorsForWindow(): GetWindowRect() failed with error %1%AutomaticMonitorActivation::GetMonitorsForWindow: Monitor info is null\StringFileInfo\%04x%04x\FileDescription\VarFileInfo\TranslationWindows Store Appssidebar.exeSecondary TaskbarStartmenuteamviewerdebug.exeteamviewer.exeTVWidgetWinWorkerWApplicationFrameWindowProgmanInternet Explorer_HiddenImmersiveLauncher#32771SysShadowBBarWindowClassBaseBarDV2ControlHostTaskListThumbnailWndThumbnailClassShell_SecondaryTrayWndShell_TrayWndtvviewmodels::InstantSupportPromptViewModel::GetPromptTypetvviewmodels::InstantSupportPromptViewModel::GetSupporterLicenseStatetvviewmodels::MdsAppsWidgetViewModel::UninstallAppApp to uninstall not found!tvviewmodels::MdsAppsWidgetViewModel::StartAppApp to start not found!

Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\Client-built.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Security\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Security.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\Client-built.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Data.SqlXml\v4.0_4.0.0.0__b77a5c561934e089\System.Data.SqlXml.dll VolumeInformation	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Code function: 5_2_00405D1B GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA,

5_2_00405D1B

Source: C:\Users\user\Desktop\lz3EbiqoK4.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information

Yara detected Quasar RAT

Source: Yara match	File source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1927009729.0000000000420000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3103987388.0000000002841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3103987388.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

Remote Access Functionality

Yara detected Quasar RAT

Source: Yara match	File source: 1.0.Client-built.exe.100000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000001.00000000.1927009729.0000000000420000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3103987388.0000000002841000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.3103987388.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Client-built.exe PID: 7464, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\AppData\Local\Temp\Client-built.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	Acquire Infrastructure	Valid Accounts	1 Scheduled Task/Job	1 Scheduled Task/Job	1 Access Token Manipulation	33 Masquerading	OS Credential Dumping	1 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	12 Process Injection	1 Disable or Modify Tools	LSASS Memory	2 Process Discovery	Remote Desktop Protocol	1 Clipboard Data	1 Non-Standard Port	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	1 Scheduled Task/Job	31 Virtualization/Sandbox Evasion	Security Account Manager	31 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	1 Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 DLL Side-Loading	1 Access Token Manipulation	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	12 Process Injection	LSA Secrets	16 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 Hidden Files and Directories	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	11 Obfuscated Files or Information	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	11 Software Packing	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	1 DLL Side-Loading	/etc/passwd and /etc/shadow	Network Sniffing	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	1 File Deletion	Network Sniffing	Network Service Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
lz3EbiqoK4.exe	3%	ReversingLabs

Dropped Files

Source	Detection	Scanner
C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll	4%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe	0%	ReversingLabs
C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe	0%	ReversingLabs

Source	Detection	Scanner	Label
https://%1%.teamviewer.com/5	0%	Avira URL Cloud	safe
https://nsis.sourceforge.io/Base64_plug-in	0%	Avira URL Cloud	safe
https://%1%.teamviewer.com/0	0%	Avira URL Cloud	safe
https://getassistar.teamviewer.com/%1%C%1%	0%	Avira URL Cloud	safe
https://getassistar.teamviewer.com/%2%8	0%	Avira URL Cloud	safe
https://%1%.teamviewer.com/%2%)Introducec	0%	Avira URL Cloud	safe
https://scripts.sil.org/OFL)	0%	Avira URL Cloud	safe
https://account.teamviewer.	0%	Avira URL Cloud	safe
https://%1%.teamviewer.com/	0%	Avira URL Cloud	safe
https://getassistar.teamviewer.com/%2%9	0%	Avira URL Cloud	safe
https://dev-trunk.teamviewer.com/CommentSession/CommentAfterSession?token=%1%&lng=%2%&version=%3%&os	0%	Avira URL Cloud	safe

Name	Source	Malicious	Antivirus Detection	Reputation
http://www.teamviewer.com/link/?url=456463mScript-urile	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/standard-things/esm	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=1653885=	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/browserslist/browserslist	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://getassistar.teamviewer.com/%1%C%1%	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/SamVerschueren/decode-uri-component	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/immerjs/immer	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=271351$Pridae	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=633113	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://get.teamviewer.com/v15/%1%vYou	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=301635lSe	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/inspect-js/is-regex	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=861823?	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=954698	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://www.teamviewer.com/link/?url=418720	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.opensource.org/licenses/mit-license.php	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://creativecommons.org/licenses/by/4.0/)	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://%1%.teamviewer.com/5	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.teamviewer.com/link/?url=456463mSkript	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/popperjs/popper-core	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://nsis.sourceforge.io/Base64_plug-in	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://www.teamviewer.com/link/?url=290947$	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_bg.dll.6.dr	false		high
https://www.teamviewer.com/link/?url=773631	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://%1%.teamviewer.com/0	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://www.teamviewer.com/link/?url=290947#	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=364272)Naozaj	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/DefinitelyTyped/DefinitelyTyped	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/ShiqiYu/libfacedetection	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=3642722Doric	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=382377tConsimt	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/chartjs/Chart.js	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/mde/filelist	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://client.teamviewer.com/intro/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%DSorry.	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/babel/babel	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/i18next/i18next	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=362946	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=934954	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	false		high
https://stackoverflow.com/q/14436606/23354	Client-built.exe, 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp, Client-built.exe, 00000001.00000002.3103987388.0000000002B69000.00000004.00000800.00020000.00000000.sdmp, Client-built.exe, 00000001.00000002.3103987388.0000000002881000.00000004.00000800.00020000.00000000.sdmp	false		high
https://github.com/react-dropzone/attr-accept	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=116574	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://www.teamviewer.com/link/?url=279064oSkripte	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=7900459/	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/form-data/form-data	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/sindresorhus/is-fullwidth-code-point	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=861823R	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://scripts.sil.org/OFL)	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://login.teamviewer.com/nav/license-activation-guidance	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=861823Q	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=461825ZYour	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=861823P	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=462409	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=666256	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/i18next/i18next-resources-to-backend	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=279064NKh	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=301635sN	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/sindresorhus/gzip-size	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz2Acc	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/googlefonts/dm-fonts/tree/main/Sans	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://nsis.sf.net/NSIS_Error	TeamViewer_Setup_x64.exe, TeamViewer_Setup_x64.exe, 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmp, TeamViewer_Setup_x64.exe, 00000005.00000000.2001772161.0000000000409000.00000008.00000001.01000000.00000009.sdmp	false		high
https://github.com/sindresorhus/query-string	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/thlorenz/convert-source-map	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=659842	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/i18next/i18next-browser-languageDetector	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://getassistar.teamviewer.com/%2%8	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://getassistar.teamviewer.com/%2%9	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_zhTW.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://github.com/axios/axios	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/download/version_15x/TeamViewerQJ.exe	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://account.teamviewer.	TeamViewer_.exe, 00000006.00000003.2385844505.0000000009303000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://%1%.teamviewer.com/%2%)Introducec	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/farzher/fuzzysort	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/nolimits4web/dom7	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/open-source-parsers/jsoncpp	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=456463qSkripte	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=801210xComputerul	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=293922	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=801210c	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/juliangruber/balanced-match	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=261802	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://%1%.teamviewer.com/	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false	Avira URL Cloud: safe	unknown
https://client.teamviewer.com/whatsnew/index.aspx?lng=%1%&version=%2%&os=%3%&tab=%4%&insiderbuild=%5	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/react-dropzone/file-selector	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=300792	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://www.teamviewer.com/link/?url=737863	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/simonbengtsson/jsPDF-AutoTable	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/emotion-js/emotion/tree/master/packages/is-prop-valid	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=301635	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://github.com/FortAwesome/Font-Awesome	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://client.teamviewer.com/blizzintro/?language=%1%&os=%2%&client=%3%	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high
https://api.ipify.org/	Client-built.exe, 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp	false		high
https://dev-trunk.teamviewer.com/CommentSession/CommentAfterSession?token=%1%&lng=%2%&version=%3%&os	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false	Avira URL Cloud: safe	unknown
http://www.teamviewer.com/link/?url=801210jUdaljeni	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=632515:Opc	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/Qix-/color-convert	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=3642728Ba#	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_vi.dll.6.dr	false		high
http://www.teamviewer.com/link/?url=9349547	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://github.com/isaacs/fs.realpath	TeamViewer_.exe, 00000006.00000003.2234544768.00000000087F7000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=801210#	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://community.teamviewer.com/t5/Meeting-EN/ct-p/Blizz)Platnose	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.teamviewer.com/link/?url=3642728Devam	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.teamviewer.com/link/?url=103286	TeamViewer_.exe, 00000006.00000003.2385844505.0000000008C20000.00000004.00000020.00020000.00000000.sdmp, TeamViewer_Resource_pl.dll.6.dr, TeamViewer_Resource_zhTW.dll.6.dr, TeamViewer_Resource_bg.dll.6.dr, TeamViewer_Resource_ar.dll.6.dr, TeamViewer_Resource_vi.dll.6.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	Flag	ASN	ASN Name	Malicious
167.71.56.116	unknown	United States		14061	DIGITALOCEAN-ASNUS	true

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1571838
Start date and time:	2024-12-09 18:41:12 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 8m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	15
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	lz3EbiqoK4.exe renamed because original name is a hash value
Original Sample Name:	33C2ADEBFE2C3ACEDFB34FFFF8151B7D.exe
Detection:	MAL
Classification:	mal88.troj.evad.winEXE@17/107@0/1
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 233 Number of non-executed functions: 75
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 172.202.163.200, 13.107.246.63
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
VT rate limit hit for: lz3EbiqoK4.exe

Simulations

Behavior and APIs

Time	Type	Description
12:43:19	API Interceptor	31x Sleep call for process: Client-built.exe modified
17:42:46	Task Scheduler	Run new task: TVInstallRestore path: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" s>/RESTORE

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
167.71.56.116	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.Inject5.1262.5931.28554.exe	Get hash	malicious	XWorm	Browse
	X.exe	Get hash	malicious	XWorm	Browse
	SecuriteInfo.com.Trojan.MulDrop23.34226.5725.23706.exe	Get hash	malicious	XWorm	Browse
	WinScanGuard_v.2.1.bat	Get hash	malicious	Quasar	Browse
	Shadow-Stealer.bat	Get hash	malicious	Quasar	Browse
	OvA6x5v34G.exe	Get hash	malicious	AsyncRAT	Browse
	zUYpYikG7T.exe	Get hash	malicious	njRat	Browse
	SdwkQEBnc3.exe	Get hash	malicious	Nanocore	Browse
	riV1K85Awe.exe	Get hash	malicious	Nanocore	Browse

Domains

⊘No context

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
DIGITALOCEAN-ASNUS	deeffrot.doc	Get hash	malicious	Unknown	Browse	165.227.215.208
	https://sendgb.com/vdRYC6Nal34?utm_medium=HlyZfLISdD8Bj1i	Get hash	malicious	Unknown	Browse	185.14.184.154
	xxx.doc	Get hash	malicious	Unknown	Browse	165.227.215.208
	Potvrda_o_uplati.docx.doc	Get hash	malicious	Unknown	Browse	165.227.215.208
	RUCkZvoDjG.htm	Get hash	malicious	WinSearchAbuse	Browse	68.183.112.81
	jew.mpsl.elf	Get hash	malicious	Unknown	Browse	45.55.200.184
	https://assets-gbr.mkt.dynamics.com/cc57758b-ada1-ef11-8a64-000d3a872ba0/digitalassets/standaloneforms/7608c709-85a2-ef11-8a69-7c1e5279b2dd	Get hash	malicious	Unknown	Browse	134.209.143.125
	https://villageforddearborn-my.sharepoint.com/:b:/g/personal/robert_wheat_villageford_net/EaAilHqK5PhBneaYfVtjii0ByKmI10BU9zhQ73pqIHj-uQ?e=FnQ6KL	Get hash	malicious	Unknown	Browse	188.166.2.160
	mips.elf	Get hash	malicious	Gafgyt, Okiru	Browse	209.97.160.137
	arm5.elf	Get hash	malicious	Unknown	Browse	165.22.138.21

JA3 Fingerprints

⊘No context

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll	teamviewer_Px-yDq1.exe	Get hash	malicious	Unknown	Browse
	teamviewer_Px-yDq1.exe	Get hash	malicious	Unknown	Browse

Created / dropped Files

C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1187
Entropy (8bit):	5.086163962802711
Encrypted:	false
SSDEEP:	24:l0m+zzDkwl0BDn+al0G+jl01++l0caMecaMIf19r3Mq3Mv3MzG63M34m:9+zcwinF/QOPVdofZk
MD5:	83BF494A1FE7D012E84D57319385C21B
SHA1:	2E50134D3E8068F9EF4ADB25C0B1D8A61EE62925
SHA-256:	89546E300D2AC19EDD38CFA8B9BC9B5BECAFAC07C278391DB2A91ECCD69089C8
SHA-512:	37A9931D314C5D27048B12DBFA7212D8A1FE56A99A01737DE58B01B1D800371A5968BC21F02EAED4ABD1A0B331F9EEF6338C2C58903DA026F8A3E33A6B07D404
Malicious:	false
Reputation:	low
Preview:	2024-12-09-12-43-05 ..2024-12-09-12-43-05 TVRollbackInstallation(): Rollback installation.....2024-12-09-12-43-05 ..2024-12-09-12-43-05 RollbackDrvChanges(): Rollback all driver changes.....2024-12-09-12-43-05 RollbackDrvChanges(): No driver entries to restore...2024-12-09-12-43-05 ..2024-12-09-12-43-05 RollbackRegChanges(): Rollback all registry changes.....2024-12-09-12-43-05 RollbackRegChanges(): No registry entries to restore...2024-12-09-12-43-05 ..2024-12-09-12-43-05 RollbackFileChanges(): Rollback all file changes.....2024-12-09-12-43-05 RollbackFileChanges(): No file entries to restore...2024-12-09-12-43-05 ..2024-12-09-12-43-05 CleanUp(): Clean up.....2024-12-09-12-43-05 CleanUp(): Unload previously loaded user registry profiles.....2024-12-09-12-43-07 CleanUp(): Install restore task successful removed...2024-12-09-12-43-07 CleanUp(): Warning! Backup key could not be removed...2024-12-09-12-43-07 CleanUp(): Backup directory C:\Program Files\TeamViewer\Rollback

C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	71272344
Entropy (8bit):	7.999987306679704
Encrypted:	true
SSDEEP:	1572864:re9Md8ir5RcKqhxdJjHKO56/nMgt5LhZx5oZiJG2Ol40hi7id:C2NdRTqhXJDLenHhZx+ZiJcl4m
MD5:	8318FC63158C01368AADC6D4BE89FAD1
SHA1:	88F4AEFCBDD5A748EC21469A565D9C57B7F6CB46
SHA-256:	B64A8F72105117FF71ECA4692DF030B6E60C4ABA2631E0FE01411086BB42B1DC
SHA-512:	DB7601C5A1AD25CF3F076C8C504EB885D3EBE6358A6490492DEE967C7FF5AC72319AAF75EDBFFD7FB0F7102473A2C16830408C7762283C67A374535EF8420076
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................b...*.......3............@.................................0k@...@..........................................`..............hX?.0/...........................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...................................rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	665954
Entropy (8bit):	5.152510122622251
Encrypted:	false
SSDEEP:	12288:/Um3jjLBanosurgrN7pF2YSz9xSnwET9XSXWOyiMilFLBuvSamXe4O7m:r9bx
MD5:	BEE0CF8EB0E6B5FE2B216EBA63DE763C
SHA1:	7B83B00CAB5529232A1B3A14253901B4E5762B97
SHA-256:	4161254F13B5A5326456E71B67B3179203DF162279183F929C8678A6FDC91B49
SHA-512:	1A56DDB9AD5D6464A88634824D4225593600D4DFFA26ABCDC5AC9D8D7B575C931A49ECA68F8AB4687B5DB8D0E9072D51AF3698B4628360C5C02B1CE0BA557BFB
Malicious:	false
Reputation:	low
Preview:	##########....@babel/runtime....https://github.com/babel/babel....License type: MIT....MIT License....Copyright (c) 2014-present Sebastian McKenzie and other contributors....Permission is hereby granted, free of charge, to any person obtaining..a copy of this software and associated documentation files (the.."Software"), to deal in the Software without restriction, including..without limitation the rights to use, copy, modify, merge, publish,..distribute, sublicense, and/or sell copies of the Software, and to..permit persons to whom the Software is furnished to do so, subject to..the following conditions:....The above copyright notice and this permission notice shall be..included in all copies or substantial portions of the Software.....THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,..EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF..MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND..NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDE

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1310
Entropy (8bit):	4.963079132684424
Encrypted:	false
SSDEEP:	24:nRLN+HfIPXHfMuubDUHeLNIWfpInUH2LpjLFAON+HfIPXHfROubDUHV5yn:C/IPX/ib2CISABm/IPX/RXb26
MD5:	E5121693356198A36982BABB96272404
SHA1:	EFF3A59DE3B562BED53FD08C5C91FAE739109D4A
SHA-256:	8E24B8D8D0305962542DBB21492ACA797F20D624ED4B0194105FBFE52E1CDBEB
SHA-512:	A862949D782607961882AAA62D1CA03BF86C61E8DD902E92AE7BF784E9B225F99613D843B16AE94EBDDA2E30B5568E202C16784CE09309B92922CE7D00EF1E55
Malicious:	false
Preview:	<Filters>.. <Filter dll = "TeamViewer_XPSDriverFilter.dll".. clsid = "{40D118AB-04EA-4CFC-8C8B-85D1C7ECB046}".. name = "TeamViewer_XPSDriverFilter1">.. <Input guid = "{4d47a67c-66cc-4430-850e-daf466fe5bc4}" comment="IID_IPrintReadStream"/>.. <Output guid = "{65bb7f1b-371e-4571-8ac7-912f510c1a38}" comment="IID_IPrintWriteStream"/>.. </Filter>.. <Filter dll = "PDFRenderFilter.dll".. clsid = "{CD087E95-A362-4A50-B233-20DC89DED268}".. name = "MS XPS to PDF">.. <Input guid = "{b8cf8530-5562-47c4-ab67-b1f69ecf961e}" Comment ="IID_IXpsDocumentProvider"/>.. <Output guid = "{65bb7f1b-371e-4571-8ac7-912f510c1a38}" comment="IID_IPrintWriteStream" />.. </Filter>.. <OptionalFilterServiceProvider dll="XpsRasterService.dll"/>.. <Filter dll = "TeamViewer_XPSDriverFilter.dll".. clsid = "{40D118AB-04EA-4CFC-8C8B-85

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Generic INItialization configuration [DriverRender]
Category:	dropped
Size (bytes):	287
Entropy (8bit):	5.371163047122097
Encrypted:	false
SSDEEP:	6:/5KsGXMfVCzpIcPxYDXQyW59bCO2MngN+jAJh6O4BVAZVhe81W8l2y:bHfkzpha8dnCOztKh6tKe8xh
MD5:	A578F666C0CB526085384D35C536B5D9
SHA1:	F019631640D4BAA684CD589696CDCF1F8252F302
SHA-256:	9C8859987D13AE53C5B206A7D59660C7754A7940185B599AC97E1E806551730F
SHA-512:	E0FBF7054A32B5C370E98A644AEC0478CC68FE5018E7B7720574E5E656C8B61FD51E712A20289DD72B38A9560D7D8633156CCF4E4302390BC180EFF1D2983729
Malicious:	false
Preview:	[DriverConfig]..DataFile=TeamViewer_XPSDriverFilter.gpd..PrinterDriverID={4949F9E6-DB2F-47B7-9489-56815A5847C8}..RequiredFiles=UNIRES.DLL,PDFRENDERFILTER.DLL,STDNAMES.GPD,MSXPSINC.GPD..DriverCategory=PrintFax.Printer.Virtual..UserPropertyBagScope=Queue....[DriverRender]..XpsFormat=XPS..

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	66209
Entropy (8bit):	4.11237765266599
Encrypted:	false
SSDEEP:	768:3E513+/TLYbpmS1Gx5M7ytzk9wjKS0ff8sEOxPOwhKGhBmAAGFD4iaKhvmOaoGJd:Cv8
MD5:	B58E72E75C1CF590FA2722ECDA95F64A
SHA1:	651B69DAADE01DBFD7CB470B24D1C3EF2369B821
SHA-256:	9C77255FA10B116C1E5D1F8AB7D12A956455AD7610905DBD05EFD6FCE465C11F
SHA-512:	6A44613F66B93DD671546042FBD0FBE2A4B78C78AC3127E69AD8794FC53AD45F2D889E6FB59D3DA5E302B9EC3CDB787818E3DDC503A47707B9FF16B7BBE5A265
Malicious:	false
Preview:	%..% Copyright (c) TeamViewer GmbH..%..% All rights reserved...%....GPDFileVersion: "1.0"..GPDSpecVersion: "1.0"..GPDFileName: "TeamViewer_XPSDriverFilter.GPD"..Include: "StdNames.gpd"..Include: "msxpsinc.gpd"..ModelName: "TeamViewer Printer"..MasterUnits: PAIR(1200, 1200)..PrinterType: PAGE..MaxCopies: 999..PrintSchemaPrivateNamespaceURI:"http://www.teamviewer.com/printschema/2018"....%*****************************************************************************..% Orientation..%****************************************************************************..Feature: Orientation..{.. rcNameID: =ORIENTATION_DISPLAY.. DefaultOption: PORTRAIT.... Option: PORTRAIT.. {.. rcNameID: =PORTRAIT_DISPLAY.. }.... Option: LANDSCAPE_CC270.. {.. rcNameID: =LANDSCAPE_DISPLAY.. }..}....%****************************************************************************..%

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1507
Entropy (8bit):	5.236509327317478
Encrypted:	false
SSDEEP:	24:f2O7xJoF+hiEvHf+My83n8rELHfVoHfusb9ooHfhHfr7BHfVoHfusb9ooHfpHfra:uO9dhiEv/+4X1/Vo/uHo/h/PB/Vo/uHD
MD5:	2C5FD2866B91861275917ADB4CED33E2
SHA1:	E76DEB1717D3B1610A769571943A9C5C5A00699A
SHA-256:	B7F148ED1BA6293F323E9834182D64E8756D414FF8A5B9B826E3EE2986E0B259
SHA-512:	EFAAB915AD8BFA769073B4CE1FEA689FF379216D04204F8B21CFC6AA41413A94EA08E19A61613DCA29649F36E82B854861397E5E1F7C450AF7A1B656A0547267
Malicious:	false
Preview:	;..; Copyright (c) 2022 TeamViewer GmbH..;..; All rights reserved...;..[Version]..Signature="$Windows NT$"..Class=Printer..ClassGuid={4d36e979-e325-11ce-bfc1-08002be10318}..Provider=%ManufacturerName%..CatalogFile=TeamViewer_XPSDriverFilter.cat..ClassVer=4.0..DriverVer=04/13/2022,1.2022.413.641....[DestinationDirs]..DefaultDestDir = 66000....[SourceDisksNames]..1 = ,,,\....[SourceDisksFiles.x86]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x86..TeamViewer_XPSDriverFilter-manifest.ini = 1....[SourceDisksFiles.amd64]..TeamViewer_XPSDriverFilter.gpd = 1..TeamViewer_XPSDriverFilter-PipelineConfig.xml = 1..TeamViewer_XPSDriverFilter.dll = 1,\x64..TeamViewer_XPSDriverFilter-manifest.ini = 1....[Manufacturer].."TeamViewer"=TeamViewer,NTamd64.6.1....[TeamViewer].."TeamViewer Printer" = TeamViewer_XPSDriverFilter.gpd,,TeamViewer_XPS_Printer....[TeamViewer.NTamd64.6.1].."TeamViewer Printer" = TeamViewer_XPSDriverFilte

C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	12658
Entropy (8bit):	7.077237390641632
Encrypted:	false
SSDEEP:	192:28vvoHISmpMCRsGyV2uR8OL7yKnUi8rFWQFgy50Nr7OxX01k9z3Azsx+ZPb9Vt9r:2Yo3U/4CFR+y50ZSxR9zusx+x3
MD5:	74134E66B593D16717C8124B0DEFA42B
SHA1:	5FA1072B57FCE09C70904464602C1FB7AD07BDAA
SHA-256:	3D4201227D709C49B77031C8BEFFBFDB09337AD6E0A171A7E058B0E0B04320F6
SHA-512:	B3A07AF69F7F0F0163CA275C153A2155BA69D7AE5371D3390F57D6448B9B17DBA60EAA3394344F8588E0102F6EC3DE72DE8E1AB6F94B5A03F2A6C192BBD9837E
Malicious:	false
Preview:	0.1n..*.H........1_0.1[...1.0...`.H.e......0..3..+.....7.....$0.. 0...+.....7...../.'._LDJ.z....!...220505065722Z0...+.....7.....0...0....R6.5.1.B.6.9.D.A.A.D.E.0.1.D.B.F.D.7.C.B.4.7.0.B.2.4.D.1.C.3.E.F.2.3.6.9.B.8.2.1...1..g0E..+.....7...17050...+.....7.......0!0...+........e.i......G.$...#i.!0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...g.p.d...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R7.9.9.2.5.B.8.8.3.5.7.E.0.9.2.0.8.C.8.1.E.C.5.4.4.A.5.C.9.5.2.5.B.F.D.0.9.4.C.4...1..o0M..+.....7...1?0=0...+.....7...0...........0!0...+........y.[.5~. ...TJ\.%...0X..+.....7...1J0H...O.S.A.t.t.r.......22.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.1.0...0...0`..+.....7...1R0P...F.i.l.e.......>t.e.a.m.v.i.e.w.e.r._.x.p.s.d.r.i.v.e.r.f.i.l.t.e.r...d.l.l...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.

C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	773552
Entropy (8bit):	6.562891536553011
Encrypted:	false
SSDEEP:	12288:E2qWLii0HeFTzBTqtO/zKSeAWgSd6kLsjJLPJC5Wdp24XgI7wK3l+aG7X:5qvxwdqtO/zFbWZ6WsjJzJ52Y7wK3l7i
MD5:	D47FE8D92AF08C8FCA8E1C71DA05CEC5
SHA1:	F53C8DEF485712748315BEFEB631453B594FC67F
SHA-256:	698FED30F5715BAA387C89D043FB0E1C8A1C4F4C8F837510DA292A943ED778ED
SHA-512:	DCCDC640981B68C3DDA4F949DAEED12F39C08E456588DE6BDD061CFE7BC7AEB18EC237E0358B6D6F368BC74F9B939D712363B2556BD9321C43900435BFAE6256
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: teamviewer_Px-yDq1.exe, Detection: malicious, Browse Filename: teamviewer_Px-yDq1.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$............................3..d.....d.....d.........................."..].....].....].&......N....].....Rich...........PE..d.....Vb.........." ................................................................G.....`............................................................. ....`...V.......I..............p.......................(.......8............ ...............................text...$........................... ..`.rdata..J.... ......................@..@.data....P.......:..................@....pdata...V...`...X..................@..@_RDATA...............j..............@..@.rsrc... ............l..............@..@.reloc...............r..............@..B........................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	8306992
Entropy (8bit):	6.537707320579697
Encrypted:	false
SSDEEP:	98304:K02Ucv1JqiXcI3NOppRGG4yf5WxSr2XdlI36mW:X2UcvGDmNONGMf5y++lI3S
MD5:	7C231D826B3BFD109350534C054EE950
SHA1:	59D3907B41AA5D1FA75127941EF542C142769097
SHA-256:	DAE032ABDB85EFB75CF6AAC20B45A7B70A1C69CA727AD52DD378C9CAAA635C44
SHA-512:	71A387790855FF661F6642D3BA561C90DAC1831423EE3C2D8670046F25BE62B757666020C87AE99F4F05A46E9DF065D45709B47F80F6675AB5038C6401FCBC9E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................8...........!..L.!This program cannot be run in DOS mode....$.........-W_.C._.C._.C...@.L.C...F...C...G.O.C...@.U.C...F...C...F.z.C...@.^.C...G.D.C...B.R.C._.B...C...G...C._.C.~.C...F...C...J.K.C...C.^.C....^.C._...^.C...A.^.C.Rich_.C.................PE..d....3g.........." ...".V`...........V......................................P.......D....`A..........................................v.P...0.v.......~.x.....y.......~.0/....~.x...@.k.T.....................k.(.....k.@............p`..............................text.../T`......V`................. ..`.rdata......p`......Z`.............@..@.data...T.....w..b....v.............@....pdata........y......Dy.............@..@_RDATA..\.....~.......}.............@..@.rsrc...x.....~.......}.............@..@.reloc..x.....~.......}.............@..B................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	85625136
Entropy (8bit):	6.658650600522072
Encrypted:	false
SSDEEP:	786432:PB4Hds6xPbqWDmXjJDGzKLZNLt+SiqDOlpf8/F8:PKHe6xPbqWyXdaaZNLqlz
MD5:	EF03E2E8B6BE62936FFB28EFAADB6514
SHA1:	FF668698839A663043B40A8017A37D56AF60A183
SHA-256:	A57EDCEB5C04052AA799EE821087C959FF6ED06351C98C0DA7C7D2FD05167C3F
SHA-512:	F5B3EDF394F939BE8A3B4FB9BDBF9A6904DD2E629070A761A28653B8837F671A975EFF5B29529C0FCEEBEFA44141768D9FE74A3B5B19E1BAF75B49B4275CECE0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................X...........!..L.!This program cannot be run in DOS mode....$.......^.=...SN..SN..SNU..N..SNU.WO..SNU.PO..SNQ.PO?.SNU.VOd.SN@).Nn.SNQ.TO..SNQ.UO..SNQ.WO@.SNu..N..SNQ.VO..SNQ.RO..SN.PO..SN..SN..SN.WOe.SN.VO..SN..RN..SN.ZO..SN..N..SN...N..SN.QO..SNRich..SN........................PE..d...P.3g.........."....".T....................@..............................L...........`................................................. O..P.....D...... &.p....Z..0/....D.X.....7.T.....................7.(.......@............p..............................text...c........................... ..`IPPCODE............................ ..`.rdata.......p.......Z..............@..@.data.............`..b..............@....pdata..p.... &.....................@..@.didat........B.. ..................@....rodata.......C.....................@..@IPPDATA...... C.....................@..._RDATA........C.....................@..@CPADinfo8.....D.................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.ico

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	MS Windows icon resource - 4 icons, 16x16, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	dropped
Size (bytes):	24812
Entropy (8bit):	5.642850515262277
Encrypted:	false
SSDEEP:	192:y/TQsT49/RA+ho5NhNsuOMVWFSY5o3VpWSYE8q3QeKT89NKqkfpqyRidOJe:XAb5hNVQStfWSr8q31NfPkfIp
MD5:	CDB33F6074944D1E46820B43B3AA5155
SHA1:	C48BA3161407C21F0FE2F1C37A93599B4B6C7AB7
SHA-256:	12D5C4D656533096A594E1EF4EB75C5EA6EA9F5DF616D84480EE6B41D41F6343
SHA-512:	9D5679E8911972D0600CD489E099F5633CAE5102F09F2808748CD4D3550F6052129407B68C624D04973EFB6264C2DCF0A66F0A014B5E8FDB1987E517218CDDB4
Malicious:	false
Preview:	............ .h...F... .... .........00.... ..%..V......... ..%...:..(....... ..... .........................R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...R...U...................U...R...R...R...R...R...R...R...R...R...................................R...R...R...R...R...R...R...........................................R...R...R...R...R...................................................R...R...R...U...................................................U...R...R...........................................................R...R...............`76.R...~fe..vv..vv.~fe.R...`76.............R...R...............`76.R...~fe..vv..vv.~fe.R...`76.............R...R...........................................................R...R...U...................................................U...R...R...R...................................................R...R...R...R...R...........................................R...R...R...R...R...R...R...................................R...R...R.

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Desktop.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	16315184
Entropy (8bit):	6.642593896924685
Encrypted:	false
SSDEEP:	98304:fOIvW9Mrz/hauvwhVr/LvISP/xHLhrUNkVQ4b4d1qGICyweztZKWs3Mxdg7hBP+b:fOIV/4uvYnvH/RtcqV1wIZ2OiVFVomO
MD5:	D3184FE9DF9AF2651D8B285978B8CC65
SHA1:	F1FF6CC86A242D09A1994D62CC96F9B8D95FE76F
SHA-256:	0D3F258763D8D5C601B558A8CD815065EE96E21C9B7800643EE2041F205D9EEA
SHA-512:	1A16D5D448DB50BA0267B70BA678E1023C8B53619DCAB36005DCF4721D518B0B089F83D06B2675305E0F48BC12753BBF958C3FC330FB8ACBBA4B858FD08B8AA0
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......9.{`}..3}..3}..32..3u..32..2n..32..2q..36..2n..32..2...36..2[..36..2\|..36..2v..3'y.3..3...2...36..2\|..3...2..36..2...3}..3l..3}..3..3...2..3...2\|..3...3\|..3}..3\|..3...2\|..3Rich}..3................PE..d.....3g.........."....".....zL................@..........................................`.................................................p#..x....@..`l...P..........0/..............T.......................(....6..@............................................text...x......................... ..`.orpc............................. ..`IPPCODE.a......................... ..`.rdata..p.>.......>.................@..@.data...4....P.......*..............@....pdata.......P......................@..@.didat.......0......................@....rodata......@......................@..@IPPDATA......P......................@..._RDATA..\.... ......................@..@CPADinfo

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Note.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	652080
Entropy (8bit):	5.121982276129856
Encrypted:	false
SSDEEP:	6144:GEPLX+/+PlxYFSCHAFUEojFN6zqDsXuiohhLdM2HBG5z87L:GEPLX+/OldjFiFN6gsXdoxaz87L
MD5:	49F29369B987D17428689C0B40754654
SHA1:	E8899D0409001C06734D8CFA865CB1DD6929E651
SHA-256:	69D3667F77429AA1E109CE766B46E8E79D9A4A496385FF7A8AEC388D329E35BF
SHA-512:	38361907CB1371ABBEB278F384792802A860B2CF61D71F74DCDFDDF7BB08006DEA16B6BEAC53E78C2E08A45969B3D46C6462785B9BC1B95F4A08CADD16F4F71B
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......H&m..G...G...G..G?...G..C;...G..C;...G..G?...G..C;..VG..G?...G..G?...G...G...G...;...G...;...G...G...G...;...G..Rich.G..........................PE..d.....3g.........."....".j...p.......}.........@............................. ...........`.....................................................(.......X....0..x-......0/..........P...T.......................(......@...................8... ....................text....i.......j.................. ..`.rdata...t.......v...n..............@..@.data..../..........................@....pdata..x-...0......................@..@.didat..8....`.......(..............@..._RDATA..\....p.......,..............@..@.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ar.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	382768
Entropy (8bit):	4.336723902201868
Encrypted:	false
SSDEEP:	3072:qNtIX+j7T4YXQwhoLZtXICyULHFjHJxnPYl+awPZVYlN6sMsd/b:qNN7T8who7DZiwP/YlN6YD
MD5:	513FFC1FB618095C2EF8C1930D782ED0
SHA1:	9175900F4A5710A1847E6FDBA47EBEEC98C1FAAC
SHA-256:	10504607478067A86BEE1DC69AB349A736B1137521A09111DFAD5721D297D00E
SHA-512:	7AA5B419438A6F8AC081B5DFE5CF6665451251F0211FEB51E58C6F293A93E0775EB319DB3D262427807CCC9DFFAE18052AE62D02924F7396C7DD8DFC18B90F05
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...d...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_bg.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	447792
Entropy (8bit):	4.274671808882741
Encrypted:	false
SSDEEP:	3072:sNsGpzFbhhqXjJbAMDZpRA01jr0fabYjby/59BoliII7psM8ZosNx2akpOxlsRaL:sNOmMYDOi8wL
MD5:	64B881D33CEFA652BC99A533296AB23F
SHA1:	218505017B86DF511B354BF5B29D4EA8131831B3
SHA-256:	9DAF7C0153B764151C1FD4D3EF0657930A0DDB5C22F51B0872B89945865B5BB9
SHA-512:	9666204AD515316D30198D591C98E9EFB45C5D675E8D1CEBBA5542D9E01E76F9478175BDDDEFD808C3729A7306A1F88AAF2593C17816086780E64FFA697CE513
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L....3g...........!..."............................................................+.....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.....3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..pd...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_cs.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	417584
Entropy (8bit):	3.944204457073994
Encrypted:	false
SSDEEP:	3072:PNE0kkALenmGn5ea0hOL/LbDusFbBtQFNWP6ZPOxjMaWg5iCFvVGZCo1yUvq5AEp:PNzlH2MQAO9u70EFUu3rbP2OoY4U
MD5:	57A20B60BDCCF1A339C607C74693D3F9
SHA1:	22C0EAD23CF35F2BE9E812CFF6B0CD5D7589514A
SHA-256:	795F05F3B9B02AEEFD6FA2165BD72A570488EB18EDD33CAFFBC96507C37DDFF9
SHA-512:	F2046606B86C429F7EEEF25BC2095EE558361ECEA5BE07691337D486BC8DE814281EFEC9CCC7421DF6A3BA2463A90757B08CE1880C2B52826ADA8DA16D32499E
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....................................................P.......0....@.......................................... ..@+...........0..0/...........................................................................................rdata..............................@..@.rsrc...@+... ...,..................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_da.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	411440
Entropy (8bit):	3.6900986952283032
Encrypted:	false
SSDEEP:	3072:NNRn5gGpUXPql7P07P6W2ZOxCT5OShtiOncyct7HeDzMC+/CDedchrfi/wzcJpHF:NN5q70sErYR
MD5:	0F7BEA067FD543BB1E216A4937724759
SHA1:	62E0D96758D1E6C127DA742653759CDE8F658051
SHA-256:	DAD39A828E6CFD77B1CEB94C2F251054097F73F20412C1F2F2F512A1BDEA5F69
SHA-512:	92093542B47F568F4D5982D0F5B440CE260012D8B6A10A3A700DB87EC1F0D59530D5954A980081D62EEAF8DFCB0F484D48C4803FD7A4FEAC5AA6097E320660B8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...g.3g...........!...".....................................................@......M.....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....g.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_de.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	460080
Entropy (8bit):	3.677814163230104
Encrypted:	false
SSDEEP:	3072:ZNs9PNMHDB74Zpf97C0QpqlCumdO5XyzTFmyGOak1vofx9fuxMBFcKjXSSnNCxpx:ZNycq6uWtvvXbG4PD
MD5:	E2803A653F35630C69E85A069A33AE73
SHA1:	BA68DF18D7DA064F6A657B2C4765A218EFF212E8
SHA-256:	C5441729770210CF2A62003293B851653F35C95014189477BB2EB8264076D6E9
SHA-512:	F025B2613A7C570F86F718B7C688D820880518BBAA0BBC876D05EEBBDC8964445B6E175B6BAC74829D0EB1F5BB6C85A728D5A4A63644D5EE6D4C90C8235A5A92
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...<.3g...........!...".............................................................e....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....<.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_el.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	487728
Entropy (8bit):	4.3924282228119935
Encrypted:	false
SSDEEP:	3072:ZNNLyTZk1/K/UKMw8LTFc61Kpl4n3INi1N5F78zocrJkdd2wQfafv+nAXFFHrfC+:ZNp7TuwSoPNdVIM44DPcB5GJj4NvFe5x
MD5:	6C8C859DFE8A16BBE7D56E18095051E5
SHA1:	FE150A6226C0D70D5CE330437AD206B6E7613377
SHA-256:	C98259E3B5942304AC53F0E8A5A95BBB1519E8DF2A292805FA67AF795B18FA35
SHA-512:	EE8C4336C219CBA6ADC2CA56450975CC0E930E7E16183598E284ECA8748736C40973CA11A0DBDF4F5289E337552340F6136FE7AFE1BD608E7F9A7164C47FA281
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....@...............................................`............@.......................................... ...<...........B..0/...........................................................................................rdata..............................@..@.rsrc....<... ...>..................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_en.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	401712
Entropy (8bit):	3.677935838671882
Encrypted:	false
SSDEEP:	3072:eN5pZMf+PIMS6rIakScR7344Pad+onG7n69vjk8Kt9ue9pQuKK5WF0g/4u:eNl0den8nILPKSeaxrD
MD5:	2D8ED226FE227D0D9BC66929712A10A4
SHA1:	5180C433F2B1BAB818B07E269F2A6B6E057C58DC
SHA-256:	92814DABD4BE397781321918006A6488FFDFD224EFA03F9487C0E42DD79B8AC2
SHA-512:	7D5929C56DFF56CFAB5981A9048B6A4032102DF7DB1645C76DD49EB185096B40189D4DB317BD79FA815807E8208BB8F1BDEE386EED1C6530996B9757574CC833
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...F.3g...........!..."............................................................{u....@.......................................... .. ...............0/...........................................................................................rdata..............................@..@.rsrc... .... ......................@..@....F.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_es.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	455984
Entropy (8bit):	3.61117792135751
Encrypted:	false
SSDEEP:	6144:MNn2TasbUVcbHah2003ABms5OU92QxLdsxwXU93sxw39uy7SBJunhLYAD75/Q7Ex:wJ/G
MD5:	3D978EABD81511C62229CA9A848D2F0A
SHA1:	F95AD8A9FBAEFF72ED36607D4388D0C2A715B8BC
SHA-256:	DE958DC2A60D9AA396EC8720D5BB39348A6785D9A4732F4EE380B663AE6E1C22
SHA-512:	D4B05C281596A00960CC3B93F3011D71EA1DB9E1073689B886F0FBC205B2A9C205D7121A3CD219D2CC14448FD0FEDD7F939C17BF3FE633DC9387157418C4EEAA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...}.3g...........!..."..................................................................@.......................................... ..@...............0/...........................................................................................rdata..............................@..@.rsrc...@.... ......................@..@....}.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	412976
Entropy (8bit):	3.6696075372697208
Encrypted:	false
SSDEEP:	6144:INdqyrKYCoUgVWOZWrmHMyJTGkCCHvG9hutYcWQjr0:bXq0
MD5:	0DC85892D76CD1102A3E6FF6E058E2CE
SHA1:	A65535E0D2BDB158F2DD6642BAAA99EBC988269D
SHA-256:	664BD7E12FFC04A71B2A8E37E8355561184737757ECB18E6806B39D011E8F642
SHA-512:	C22A90B29602A096ACA792F91FF164E68DF7126A44E8429C0B4B9724C50B459B3CF9C835582FD704397F031AF27EBC9D608A4AF484B56B774388202925395EFF
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....................................................@......']....@.......................................... ..`...............0/...........................................................................................rdata..............................@..@.rsrc...`.... ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..@....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_fr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	475952
Entropy (8bit):	3.6413069266245923
Encrypted:	false
SSDEEP:	3072:ANi0IvRbnBkCYE4fMhAJZ2W6Y+ZyeApDk9557FjZwntu0Nj/C:ANMneOI38W6Y+ZFlVwnD6
MD5:	5B97F99ED3B5A99DC413500F3A7020B8
SHA1:	BD4395CC149E4079E24A5DF5998EA700E3825E1D
SHA-256:	10B0460BB5F0B94C15231FEC7054F1B6991E039FCBAC20C93173A5A6F1D9BD1D
SHA-512:	7262984BE72D878618DA0344E235079D4C5CAE19093D2B553923716D931A568FEEB3AEF11290E794B0D3E230FA13A012E922F472F55EFE261ED9BD41452237E4
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...Q.3g...........!...".....................................................0............@.......................................... ..P...............0/...........................................................................................rdata..............................@..@.rsrc...P.... ......................@..@....Q.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..0....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_he.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	336688
Entropy (8bit):	4.465302989031539
Encrypted:	false
SSDEEP:	6144:HNwE86CVLIADQQLjQOu1r7bihsvEojtJkKsQ/ILEis:J868UQLjQOu1nbiO4KsQSs
MD5:	A0D36CD17EF93A6052432FD90120FABD
SHA1:	4C4720305FF8C2D8547B93D5E8779849FF24039B
SHA-256:	CBCE1AA9CD42F5DA131D303B7D2B89ACE839F55C570DBB3BB8283A63676CFA2A
SHA-512:	7E8148444BB4F748C73D03FD0A133B05330E46CF9415133E14DECA5A7F1BA6B36BFEF37518D2DD1D3AD512E60DBB98CFA44FDFA48CDA454AEA4066ECFD56988F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..`....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	434992
Entropy (8bit):	3.7404379881615846
Encrypted:	false
SSDEEP:	3072:zN26UDABostCju38Zwxl7OafE+KSBA5fEMumY0oR17ifc+Wv0kk7n3/SUvb18R/+:zNFxztCSsZw37DkSWsZRW
MD5:	C1E3F2D4FCBE719BE85D55673B63BC4D
SHA1:	8D8F12A4B968BF4B91F92663BB2ED90ACF2C9947
SHA-256:	3DD5EDB2ECD62DF1CD05D9797223F3E464DC10D7052B38352094627A41EE7BA4
SHA-512:	E2287157B693DF4EBE7557D41DAB7BE098348BBD7A93FB72E8E1F31DE64DBBA89F67C3467AC53417716FDC34310CDE88D44CEC709EE7E48F6BFDA27F59D48B3A
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....r......................................................X:....@.......................................... ...n...........t..0/...........................................................................................rdata..............................@..@.rsrc....n... ...p..................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...1...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_hu.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	448304
Entropy (8bit):	3.819894570217334
Encrypted:	false
SSDEEP:	3072:0NJBaDYxtVtcuehcMLhg5RcQ98xYKpYNtwzqPs1U5ihwv+Yk/l2SPyiHo/c5ZQRT:0NEQRyT50yXB13oFn32+sdgwVsT
MD5:	0598E989FDBAC8A3BEECCB82228EFEF7
SHA1:	B687B2F33BBDE2D3CB91FB794AB4717E7C56508E
SHA-256:	CA5AFDEACE4F99DF885DC1CCA7E8A5430B91E193610A2B05585CE7DD26D83379
SHA-512:	35163A1DFA7CF622B088E8872901C0ED17C2CD3E2BE000AC28F3B30D75AD9131FC063813CF91161B4B1910F9F48D2CC5C1BB1967E7AD07FA7A574F250F0675A6
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..8...............0/...........................................................................................rdata..............................@..@.rsrc...8.... ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...e...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_id.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	419120
Entropy (8bit):	3.647004993502636
Encrypted:	false
SSDEEP:	3072:vNAk95jHDue/7RhlV1MjqnsIjydlyjOWPvma+pnGAg4NtgHzOi/hX:vNd/T7FbRjydgCC1
MD5:	7837FB6EF7DF09CB67CAFA715334B819
SHA1:	32986BF01298CAAF7FB897D6CA78D3642A4E96D9
SHA-256:	703C9BC5288175973AED875954767170ACBA696364181952872BC0C162DA6B96
SHA-512:	40859ACC024EC464FDA1C788ABF429186B56DC01345D423AF20EB2B8EDB5EE988EC14F44A85706882142615A7EC23A0FF1AD94D17FE1A30C4727EF557CFE1B79
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...#.3g...........!...".....4...............................................`............@.......................................... ...1...........6..0/...........................................................................................rdata..............................@..@.rsrc....1... ...2..................@..@....#.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..p....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_it.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	451376
Entropy (8bit):	3.61660465185004
Encrypted:	false
SSDEEP:	3072:tN5p1SOwQZ0I/09YiX4EJDH8efKHDu3wZMBTwvl0VAaRIwQ3/oMtdCmr4O+Aa02f:tN5TNwWLEtHt0MIWAaQm8dQ
MD5:	08664CDEE9083323BD2A512A422F4442
SHA1:	2D22989ED8FDFAB69FDA83E9D3AC122235AE96A5
SHA-256:	6811A198C67AF6909BA0A9E36974E8BC7A0D247F577041E66F13B9DEDCEDB4E5
SHA-512:	6A6AAD8BDE712F4BEFA37040D4D2FD7CF1174D6C7A0865F4499418671EEBCE359EE169FE429D331DDCB2CB2778C3416B78FD39C959FE75C5BC54E54AD72FC4E9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...].3g...........!...".............................................................:....@.......................................... ..X...............0/...........................................................................................rdata..............................@..@.rsrc...X.... ......................@..@....].3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..8q...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ja.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	255792
Entropy (8bit):	5.5239889037798156
Encrypted:	false
SSDEEP:	3072:BNHSBUYYv/SV54CE9J+45tpVCQGu7lUzVWSqZAxXakiAVwz/YDTgcDcO2t3qdcB9:BNHpXlzgVw0YPBGl9hk
MD5:	BA4482F5BB4FE1AC104E64F0315B342D
SHA1:	DDFD3DB8FAF065D6E80A02DC49A974D818B3F862
SHA-256:	E488FA29DE9FE6700B9870D1BEA99BED95906ABEE53D5445AC61D246B0D10FE7
SHA-512:	C803DF25F6DF0B32D92AB9D8E6F6D5B5F65B965EBA0E60B9132E54FB0E3FCE3A8C969B0CDFB23ECAB9F9E7AAD6C164D726ECF4A43D53F1D0CB897B15AEDB9D9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...u...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ko.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	249648
Entropy (8bit):	5.644474255154363
Encrypted:	false
SSDEEP:	3072:tN4uHCzHKIQnZcmPTp9vgeSneem/QVBbTHvui9BqV4DSjlkSdlCHCqze/a/E:tN1C+5cm+9BUys
MD5:	12AD084B7547058CAD474BB3951E912E
SHA1:	0F33E3CE36CDC1B6317661E29F5C3ECBCCADFFC4
SHA-256:	0CB6F9D7E08CCF07BDDF825AEAF45AAFE3E7D9E89666737890F4813BD63BF57C
SHA-512:	35DB3181C3D5103F615A7435C96E7E7FF9CB216CD6367829BD513D168F04AA5A375542E1D81B732685E81D567F9D5733598334642826BCB1B777E5EDFB4813DA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."............................................................e.....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...\...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_lt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	441648
Entropy (8bit):	3.824660956670209
Encrypted:	false
SSDEEP:	3072:5NF28cWe59Jjva4odQDyPh8rp2NgFgXkLZB3fUEO9VZ8vllQBSCTupSCjh0fDxd6:5NM8+ZInNXIok7
MD5:	2DC459ABDBAC050BC9BF128687E4B3DF
SHA1:	B2E74BFE4F7624BE4BF9D5980E8D58988742F367
SHA-256:	560D9DFF99F732ECAC7A66C48643352D0FEB92C65469CFCFD4B480627796FEE4
SHA-512:	62629AEA3AD82FB4BFD2D58DCE2E6BEBA5DD8397C721F9809AE59000A9A025CC502C65FAC69A801F144A1A0EFEB50D0378882A2E0AE06C867FFF5A31F4ABE8E8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.../.3g...........!..."............................................................O.....@.......................................... .................0/...........................................................................................rdata..............................@..@.rsrc....... ......................@..@..../.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...L...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_nl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	444720
Entropy (8bit):	3.628002476208683
Encrypted:	false
SSDEEP:	3072:PNxfX37/LbVWPIogpG2QVUNw/rn3teH/QURrFkaVYx9jUrptaasWaT8FxaKTJvZG:PNxfhqvWUF1vr2vFVsWSlB
MD5:	51C094716CDEF71171609903C8AAFFFF
SHA1:	AFB6CAC59BEC2540191B4FFA746D7CD90F4E6D96
SHA-256:	02988E72FC4383C09FC88CD08558B8C8D882B4D8E011A887354DCC093C14D267
SHA-512:	4F06E2AA6A52FD7A9BA329B1F93B11C3ABEC03103F5BB9B241C37B8F93B3D8EE9BE988FD1A907EB4DA67C3F613818D8FBB7D95CD3F3547CD32F0CF67E12B8944
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...r.3g...........!...".............................................................G....@.......................................... ..x...............0/...........................................................................................rdata..............................@..@.rsrc...x.... ......................@..@....r.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..XW...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_no.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	406832
Entropy (8bit):	3.685184360796393
Encrypted:	false
SSDEEP:	3072:pNEcw/9/mYX/bXrQPo1vhctz/psJAQsJATfhzxATelfVJ5ZQNU/J2JMw19CgMhnX:pNRlx3Zfmd
MD5:	0F3A79C7B0C1E12363DD667B68EEE909
SHA1:	D7195A330B9F3CB240D1C4B587F4C39E84D6171E
SHA-256:	12541948539D17AC3B1CF7D08A24060920719B9129790CD3A63167A32055FCE8
SHA-512:	8A7C2C395630CEC128BD1DBF3D4C2C788216356E0BBE6A8BE6FBAF608D279676A1B16457BCB5941A8E1CDB3CCEF2889ECF8FC61659C557A641F8F6BC2EB1A260
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....................................................0......P.....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pl.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	444720
Entropy (8bit):	3.8844397051722477
Encrypted:	false
SSDEEP:	3072:7NaAQtPb/oZo4synbxIkqZd87eEIspDhDYDt/dch+jEa6OXyPZU/r:7NkmvHpD9YDta+gCBz
MD5:	61E43AD0B8D5FF40D0DE1FC348050D9F
SHA1:	A91BE32D753A281AA7E2D186A100DDA0821D8BC1
SHA-256:	180D2590B2474C310D33F5E1C386004A36A517EC1A0E857D9758A001D9590ACF
SHA-512:	BDE04951299F53DBB4B9B96AEAC2FD293FC794E56F06517EF820D032FFCC422C5FDE6F7560BCD0DB7C113E2B34F7B059E6010413CD47561705DCAD8A7D352C2C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L....3g...........!..."..................................................................@.......................................... ..x...............0/...........................................................................................rdata..............................@..@.rsrc...x.... ......................@..@.....3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..XW...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_pt.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	438576
Entropy (8bit):	3.662598624261109
Encrypted:	false
SSDEEP:	3072:UN99HXpcYqo/SB+keVl6RQ1OMQLEvDDaS7kpx/Xz:UN37/naRqlW7
MD5:	7FC44921490C9B659CE21014F29E02B5
SHA1:	41841820C81E84B3A153D1E71BAD90A1CCB9E8D9
SHA-256:	B772E0F9EB92A7D79FD6E383E446727CABA1A0BCA1725E719EDE2B2A75A35B57
SHA-512:	6CFA2404F2D000CD16F139D41DE7A0F5DE58E279FA2857AB7EF477AA06B645CB37D326C7EC2EF1D7609191286B7B93C81F3361BBBAC5C653CE887EB6979EACE8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."..................................................................@.......................................... ..8\|..............0/...........................................................................................rdata..............................@..@.rsrc...8\|... ...~..................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...?...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ro.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	462640
Entropy (8bit):	3.760042685339397
Encrypted:	false
SSDEEP:	6144:GNxlPqoAmTY+mO/5z2ap8ImhBpr9pmZsnecOHOPCC4ui3gXXjtRUpgJKlAqlwSoi:Dls
MD5:	64368FFD42598CEEC16C5CB6EF28B086
SHA1:	CA81EFA15B0C115F741D325747F1248A2A1BDF73
SHA-256:	9BA335C6BF51352EA96474A0216415942D361744B5D96CA1B53FE80A9CC89C3D
SHA-512:	DD2F825A66987173AC7D214F933B11F97C0C3F334DDA09B50D726C5602A4D9E59F86772C50CF573A02A184B9CE3761455D9D524B8453E2F3FA6AB06CE293FE02
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...:.3g...........!...".................................................................@.......................................... ..h...............0/...........................................................................................rdata..............................@..@.rsrc...h.... ......................@..@....:.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..H....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_ru.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445232
Entropy (8bit):	4.345162063583558
Encrypted:	false
SSDEEP:	3072:8NZQWwJlyo2D4i/IvBgWrCd+y5jsgj2eaqh/6y1wBMktt+WX8dLTOsiU/d:8Nw04mut+tPl
MD5:	976A3EF9EE5553B73F36A6CA646A3A35
SHA1:	E5667986292B0D25B333F94C23BA4A582DE4C2C6
SHA-256:	F02163EBBE7C856374057E979B2CC8D7D1841EF5A58815CA4F7F9DEE2F9E373F
SHA-512:	E231DBADDB70E47F2DD983E3A45C699C68B66E0C9EF4ED995299E6579F0DFE04BF206C650D85C8580EB6478548B3A1286D3D53D00A1CD84AE2DD53434EAC614F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!..."............................................................q.....@.......................................... .................0/...........................................................................................rdata..............................@..@.rsrc....... ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...Y...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	430384
Entropy (8bit):	3.881624332655778
Encrypted:	false
SSDEEP:	3072:6NVr+CzkliVLjgTllqcfO5BT7bF9mQeLF7A2ubIr3S4WWe/jHHtc6B0qzDWA5lP0:6N+vp0qlSg8N/ZBHPg
MD5:	E6929C83BA3FB74DF718BA370BF88AE4
SHA1:	6F833CCDFDA5DF382D87DA3CE15215A1B53791D5
SHA-256:	0F0CE1A8C2B07896C04D378B5B8187BD3106FB16A239CC79C595DB30431D32C9
SHA-512:	7BE761D5407ABF4CE1E7EBF9C171A695232071E32578F339707FADE588E0EB26B6B45875E9936B3EE279CD5780559E88B6C9A3CEDA7ED752DC390938D1F2F64D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...E.3g...........!...".....`......................................................(.....@.......................................... ...\...........b..0/...........................................................................................rdata..............................@..@.rsrc....\... ...^..................@..@....E.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..h....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	429872
Entropy (8bit):	3.742433535213962
Encrypted:	false
SSDEEP:	3072:LNPOD/v+AHa291uVZVAZcMMv40K4+0stMpNu3k3+hB/S5Hs7hUvEnfS755P1ER1/:LNsVaYW540JHpUUIn+3PHmXWbsmdstr
MD5:	F46651A9BEC66D71EF2A7554B3731463
SHA1:	49B0E0FDB9438848B86244F47BF2999A4FDE4144
SHA-256:	1A5DD2142C66BECEB99415B0A1ABF2BD0310857B6A4B61E099506CEEE59A73E3
SHA-512:	B495070B05A87E6D232532EE0C0A68258BEF153E8F626FAB3473D33BA74351951D7C7D3BD89978F55A5BC2C645B3D902661BE56CC4BBC8387AB337305A1A71F5
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...P.3g...........!...".....^......................................................M.....@.......................................... ...Z...........`..0/...........................................................................................rdata..............................@..@.rsrc....Z... ...\..................@..@....P.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_sv.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	410416
Entropy (8bit):	3.724018748105119
Encrypted:	false
SSDEEP:	3072:8NeQ4ns/DX8CNRbjDr1E4kHk7IFBMlU/Wo7UwQddabm7Doe51jaO/YV+tL8tVL3l:8NeDnp4XkoB1bhFBY
MD5:	C9B3394CBF0FD17C4CE80933754392B3
SHA1:	37A51405221AA2CCFED69021EB097F8D579FB399
SHA-256:	30BCB07C1A52B6D49A1816377EB6D2F34E8CF63DECBCBF2256339DFD515E2FFD
SHA-512:	FFC6EC98A16B9FE9DE7A5B0ED3EEAE2649F1E883596786AF8CF860E32B5E9ABE714C8D3DD2EE2405CC9DD7C6643BD8886AB5373B2596BA9ECE2C542B5D7B2881
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L.....3g...........!...".....................................................0.......Z....@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@......3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_th.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	397616
Entropy (8bit):	4.5378484416090945
Encrypted:	false
SSDEEP:	3072:gNSiyD1Ja7bVSCCn8a/uO9NanCBhBh79pwhZpk1gFMGSI3yeB73u+bf/DC:gNUgRSHQaI352
MD5:	99289969CA72D6E7B5AD982730A1641C
SHA1:	3ED18D9FAAF32DC00D11F3377ED6FF59841BCC35
SHA-256:	837783AAEF963F2F5DEB0B22A7CE875F9900FF61CA41E9362295E457FE1DD959
SHA-512:	A21BE03A91E646A441CA4427428F9594D79427F3F7EA0001374EA214E09B7AB9C585D8DF1ADA682D3086DAB29052170B0713E69E00D4C31FE803712FD09CFBF8
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...[.3g...........!..."............................................................q.....@.......................................... ..@...............0/...........................................................................................rdata..............................@..@.rsrc...@.... ......................@..@....[.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].. ....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_tr.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	415536
Entropy (8bit):	3.8945278850522436
Encrypted:	false
SSDEEP:	3072:DNP/M4v2h5ooD6qrQrxO9VEaOy/4EZPvsnNM+cJRS1klrD5oNAr0sJIS8HEEiLnM:DNX6zvsnNCoXw9hRacRzc7yj4
MD5:	AFE6CF3CEA7F0453F5B678CC9AF1CDE9
SHA1:	17566D68DC26838C51274295CD1B519D49F22691
SHA-256:	48015D7439ED9FB3D86B778525BE8C9B1C49E75855BD82DC55B616C0D05B4956
SHA-512:	FB44757317ACD945960C6FF728E0FAE05ADB0AA865C95F05A63E1EFDC49B50775C09D7CA25986354E8B0DCF345A4449950356EE285062A419E83DD022B73CC30
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L....3g...........!...".....&...............................................P............@.......................................... ..."...........(..0/...........................................................................................rdata..............................@..@.rsrc...."... ...$..................@..@.....3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ].......rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_uk.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	440112
Entropy (8bit):	4.368660233666246
Encrypted:	false
SSDEEP:	3072:MN8D1xxNKRcO5TyZUUJPKY4jgUgRQiXYL7fe/7UVitNbwyjCAyyaaiiQjFqZ0UFd:MNQxhTGkt/Ljok
MD5:	0B8832DE8B98424331A3CEA77561DB3D
SHA1:	3AA10F7B386706EB95E7126051BDA8313AE7A79A
SHA-256:	D1A86642F816EACB751D997E53557916F79213CA994B5FC1CA5F98B65868DF0D
SHA-512:	B25D703A187327D3C253B259EAEF6D136069CCF0D86605E6B98698275FD5BCDC42F83C43C1E444F3272BBEAB3D441481D7B353F55C689836FA431BED026818AA
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...f.3g...........!..."..................................................................@.......................................... .................0/...........................................................................................rdata..............................@..@.rsrc....... ......................@..@....f.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]...F...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_vi.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	445232
Entropy (8bit):	4.197917458611077
Encrypted:	false
SSDEEP:	6144:fN0F+xOdgYDbwp68tkyfTdHid5s2ZMQkeMZs5rceohHLx:SvpUaSrx
MD5:	A28F6234836449378972FA4C49B1B573
SHA1:	F11556BA5621B9C844625717F7713D6A294AB984
SHA-256:	9A4DDF7E4F561ECFEF63956FCF23304724E6B5DA30FA1734BC22AB8129E00F3E
SHA-512:	02649268CE8E7AF99E63CD47659160853BFCEBDF9DAE026CDCFA98CD4A0F7D23B5A41763EA4B41D19B742BDEEDD8AC483752FCFB516ABCDB8114A4C761B2A187
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...q.3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@....q.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..pZ...rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhCN.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194352
Entropy (8bit):	6.058995434031819
Encrypted:	false
SSDEEP:	3072:XNV5FxIjlioSnfY9yIGJD4Gh+jrOZUiXQU+k4yLfg8OQWQRt3/b:XNAjonQ9yIGcjniek4iX3T
MD5:	21EAD4236D0DD62F19A48E657DFB342B
SHA1:	206E222004E281D5C21E99C2FE4807A0776F5F81
SHA-256:	CC9F0B70C3496FF16302F3CF52703E4D98040419D5948EB8651C2357B9BFDD53
SHA-512:	8050175B360FF1FBC18756FDF81C7BCCB7BF18BCFA5A9DECFA422D4DBC3A28676C05D2068DCFF9340F2308166A61A6E915A8664251B77D3E0BC1D48DBE6ABA55
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L....3g...........!..."..................................................................@.......................................... ..................0/...........................................................................................rdata..............................@..@.rsrc........ ......................@..@.....3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..`....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Resource_zhTW.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	194864
Entropy (8bit):	6.099202422195636
Encrypted:	false
SSDEEP:	3072:gNIm5gMYHcWLiw7iHuvCwRNMdMHa/5MuAi3ZQUhkZVx8906OU/SF:gNImcHc6HUkNRHa/5MuA4QUhYAOUaF
MD5:	D31C5EC36B40C97A970E5DFBDA2A0C44
SHA1:	141C4A2918C6305B02E2683121F4B385BE51ED4C
SHA-256:	A3F0622DADABB8264DCB0CE1C25959347614F54448F781F69CF4825E8BBAA3D3
SHA-512:	2B53489CD34E828346BC0F1C77F288510A3BC69D3E69456786BC80DD665FF051AEB32A90169D7D09A7007A8F6DC6FDB6E4FAB906857808970594714A60AD48BB
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........PE..L...\|.3g...........!..."............................................................W.....@.......................................... ..x...............0/...........................................................................................rdata..............................@..@.rsrc...x.... ......................@..@....\|.3g........l...4...4........................................rdata...........rdata$voltmd...4...l....rdata$zzzdbg.... .. =...rsrc$01.... ]..X....rsrc$02............................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_Service.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	22681904
Entropy (8bit):	6.631480939944556
Encrypted:	false
SSDEEP:	393216:KcTW/8hgQcbLqItw/cIqiQwxhWt24zvIR:KqQcOs
MD5:	E901C556A63E8738AFFA2D2F1C82DA4C
SHA1:	87092E6C7A60C8E8595A7C034DADFAA55DFF417D
SHA-256:	4E40C3381FB5A99BCC4ADF2E3B6F3ECD1E224C4CC22B39648552EF4514EA933B
SHA-512:	314BED464671B2B5E9A94B3EA2E3BB2E3899A5B5CAFAD146691B5A6A009D50414DE2A84B518E2F7B253F55CD7393EECF7F5C3D73A9D443164689174069FF21B2
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................H...........!..L.!This program cannot be run in DOS mode....$.......O#...B}J.B}J.B}J@:xK.B}JD>.J.B}JD>yK.B}JD>~K.B}J@:~K.B}JD>xKqB}J@:{K.B}J@:\|K.B}JQ..JQB}J.>~K.B}J@:yK'B}J.B\|J.@}J.>xK.B}J.B}J.C}J.>yK.A}J.>tK.E}J.>.J.B}J.B.J.B}J.>.K.B}JRich.B}J........................PE..d.....3g.........."....".F...vo......?.........@.............................._.......Z...`..................................................VC.(.....\......`S.49....Y.0/...@].8....^..T...................._..(...@...@............`..`... &C. ....................text............................... ..`IPPCODE............................ ..`.rdata..B.T..`....T..J..............@..@.data...\.....C......`C.............@....pdata..49...`S..:...jN.............@..@.didat..H.....[.......V.............@...IPPDATA.g.....[.......V.............@..._RDATA..\.....\......xW.............@..@.rsrc.........\......zW.............@..@.reloc..8....@]......"X.............@..B........

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer_StaticRes.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	36885808
Entropy (8bit):	7.909820490100587
Encrypted:	false
SSDEEP:	786432:KSLjrC6ES0BCVUx2qRw4nZnv69fakl8Q8kpwDQ6/Y:VLf+2m3hqSCZoI
MD5:	4161468092501B8739E3411C5E423002
SHA1:	F3007F049E8E3272058CAD1D32195E28580359E3
SHA-256:	FCD688CA0D1DE2AEDE56E5736D63F7A12BD6BEC5C2C927F149028375762DC736
SHA-512:	8F06DF358486259509CB73C3C73387524E73C563B2388F50F59F77BA52F187378DBA2BEDB675F2EE7A65B55DC20228FFEEA03AC0E1A3BE7E78E6B8AFDEFFFCB9
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 4%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........F..Q'..Q'..Q'..[,.P'..Q'D.V'..[..P'..RichQ'..........................PE..d.....3g.........." ..."......2...............................................2......03...`.......................................................... ....2...........2.0/...........................................................................................rdata..............................@..@.rsrc.....2.. ....2.................@..@........................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\WriteDump.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	518960
Entropy (8bit):	6.393116974761183
Encrypted:	false
SSDEEP:	12288:IjcUW8R1ZXBVmLpjmjXY57NIk/Vo693Qe9:IjcUDRnQsXY5h7/VfBQO
MD5:	3075E4759956DCAA841ED4C416F89C92
SHA1:	A650F1FBFC3DBB9A1DCCED09EC9B4F342F22C0BE
SHA-256:	9B9B433FEB51663EA5351C7FE63881B1F721AD8B16A9ACC27D7EBED0A639CEC9
SHA-512:	E6AB3EB08C8087F5015FF85D4CB82AEC7A14E1909F75A25FC7B61D662096C47C82637C1B545F16AF791FAC61E4A082C3E68E45575A4DEEC12907C85F72F35006
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........IS..(=..(=..(=.P8.u(=.T9..(=..T8..(=.T>..(=.P>..(=.P9..(=.T8.(=.P<..(=..(<.u(=..T4..(=..T...(=..(...(=..T?..(=.Rich.(=.........................PE..d.....3g.........."....".......................@.....................................?....`.................................................H...(........l...0...C......0/......L.......T.......................(....(..@...............`............................text............................... ..`.rdata..............................@..@.data....J.......2..................@....pdata...C...0...D..................@..@_RDATA..\............<..............@..@.rsrc....l.......n...>..............@..@.reloc..L...........................@..B................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\crashpad_handler.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	1714992
Entropy (8bit):	6.546953457862245
Encrypted:	false
SSDEEP:	49152:xpQyGyf6Rxzu54UP7OKkxlFsuKdHVTtajlGA:xfGfRpUA
MD5:	248C2A80CBD5647C23C55CFE70D843BC
SHA1:	31275E7C87AED241D3871C9A805B2D2EA10F3758
SHA-256:	99464B26D99A8187194E7580011FD0E5FCEEF9BCFD5FC85A36400F5CBF533060
SHA-512:	133150B983C61C7CA28D5C35728092CAB2FFD822FCE8C42B8D29BE9355D1C294D97E8ED76B56EA0D4E18C06C89D55A98E6D4859D82258FE38A627C05C4E14D9C
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.................................[..............................:..................;...:.......:...s...:.R.....:.......Rich....................PE..d....j.f.........."....".....l.................@.............................p............`.........................................................@..................0/...P..@.......T....................!..(.......@............................................text............................... ..`.rdata..............................@..@.data...(`.......>..................@....pdata..............................@..@_RDATA..\.... ......................@..@CPADinfo8....0......................@....rsrc........@......................@..@.reloc..@....P......................@..B................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\outlook\ManagedAggregator.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	17712
Entropy (8bit):	6.949643172483514
Encrypted:	false
SSDEEP:	384:2LGBxtmkhZSf+VIYic51LgdkSJIVE8E9VF0NytJ:2LIxtmkw/Yic5A2Ep
MD5:	4D6089A8744DA5197DF65AFF0567E893
SHA1:	31F6D32398CD3E465A95B1E40383981E4979167A
SHA-256:	D96179353562C8C7F39C3CB8D7D3F9815CF8AC6F19A00627480CF37EA6DE1515
SHA-512:	4E60F4891EB101F076BFDC59EB0EDFE48AEFAF7336F0D5818BB52BA2A50FB757F7D1165C0AA77A2C65BFB501A6ABB0B69445C0278A94F51930792395047F0773
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L.....3g.........." ..0..............,... ...@....... ...............................T....`..................................+..O....@..................0/...`...................................................... ............... ..H............text........ ...................... ..`.rsrc........@......................@..@.reloc.......`......................@..B.................+......H........ ..4...........................................................0..b.......~.....~......(.....(......o.......(.......o.....0.~....(....,..(....&.~....(....,..(....&.(....&...........%1.0......(....BSJB............v4.0.30319......l.......#~..........#Strings............#US.........#GUID.......d...#Blob...........G..........3..................................................-...........................0.......f...\|.f...].f.....f.....f.....f.....f...7.f.........B.....

C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddIn.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	355632
Entropy (8bit):	6.544582451742204
Encrypted:	false
SSDEEP:	3072:NY4IB2B+o2FgZEdOD/eSsgp2YX58ODnEpt0El4NnUszFoSqrzqwX9ZDuaoos0aEo:OOdqZ8lJDn20ElV0QmQg308
MD5:	A3448D601918784C38F202FEC27FF8A4
SHA1:	1254E9362FBA584C7CC5634EBEDEB71F74ED195C
SHA-256:	027BC60E1C036D170398A289B7FA2F6C9161A198C48346D6F847E3EA63F4AAC6
SHA-512:	224949BE3684AA7EB4812E8A3FD34580898B8645E242C52E0C10EBE776C878BB925482FE11264E9C74855E63AE6680ADF310B3563BEFEA7829133531802BAB25
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L....3g...........!.....4..........rS... ...`....@.. ...............................D....@..................................S..W.......`............>..0/...`....................................................... ............... ..H............text...x3... ...4.................. ..`.reloc.......`.......6..............@..B.rsrc...`............8..............@..@................TS......H.......(....f..........$....\............................................(.....{...."..}.........{...."..}.........{...."..}.........{...."..}.........{...."..}.........{...."..}.........(......{...."..}........0.. .......s.......{....o......(....o.....2.(............6.......(..........0............o....(.....o......E............#......>..........Z...u...........................;....8......t....o....(....8......t....o....(+...(....8......tS...o....j

C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	139056
Entropy (8bit):	6.532462408923504
Encrypted:	false
SSDEEP:	3072:miieN9+xseRPLVfO2jiQpp0woz/cLruLwNiCoJa/Y:mpU9heFLRjCQadJaA
MD5:	E5D8A7EB95C608523C9F8D1753691474
SHA1:	0D20930588A8EC799D97A7DD13967E6CCF9973A7
SHA-256:	63BC815B7896DF84C73489BB12C3845E5C3978AB9BACD5BE69B91F6528EB86DE
SHA-512:	28AC0BD57201455CF5D157DAED6D8FF0F52AD5550ABD3B6505CF6FD5C1108537296F7A218C413ADD83395A0AF98AA52E8C35F7F2768CAA68E98A77A7637AEF6D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$........`E...+...+...+.y(...+.y..\|.+.}/...+.}(...+.}....+.y/...+.y...+..S....+......+.:}....+.:}/...+.:}+...+.:}....+.......+.:})...+.Rich..+.........................PE..L....3g...........!...".0...........{.......@............................... ...........@A...........................................P...............0/.............T...............................@............@...............................text...*/.......0.................. ..`.rdata.......@.......4..............@..@.data...............................@....rsrc...P...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\outlook\TeamViewerMeetingAddinShim64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	182064
Entropy (8bit):	6.2310805988584175
Encrypted:	false
SSDEEP:	3072:9gRdGN0Ik4/3dGctH4Xmyw0hHRhzopV+9JmTBZ1wuwbPz4efAAYVqsLiy/q:kC0r4/3dRHSmv0hHRlI+9VSPV1y
MD5:	61AD15F02535262E120D16CC1642ED07
SHA1:	B179B3ABA71D55A022361B0DF30946316FB318DC
SHA-256:	54AEA2D51D13F0ADD6B5738D7A0D7399C4531F012358245AF85932784BF44ABB
SHA-512:	A671493B783DC9C9D4C5D95E64C84940EF352E4BB4C5B5E6691DE56332855920065A22173BA87FA84545A28EEED16BA96D6217E96171EC5A23676FFDCA4C771D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...................................(...........!..L.!This program cannot be run in DOS mode....$.......B....\|.].\|.].\|.]M..\.\|.]I..\.\|.]I..\.\|.]I..\)\|.]M..\.\|.]M..\.\|.]M..\.\|.]...].\|.].\|.]{\|.]...\.\|.]...\.\|.]...\.\|.]..f].\|.].\|.].\|.]...\.\|.]Rich.\|.]........................PE..d.....3g.........." ...".~...(......`.....................................................`A.........................................S.......S..........X...............0/..............T...........................p...@............................................text....\|.......~.................. ..`.rdata..B...........................@..@.data....$...`.......R..............@....pdata...............f..............@..@_RDATA..\...........................@..@.rsrc...X...........................@..@.reloc..............................@..B................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	479536
Entropy (8bit):	6.914122396366591
Encrypted:	false
SSDEEP:	12288:ITbmbvN1jVKS3+dIPIkuFRYoevk2gpb45w3n:ITbmbvN1VKRdIA12gpb4i
MD5:	2499441F9DA7A30E39B38EAF9D38BA1B
SHA1:	7150959613391297B73EBD918F0F5BFDAD4921A5
SHA-256:	6459A030059A3054ED1C42D7F195DE1B0B04348300BFC1469016E2D5D4A65FFA
SHA-512:	0487CF992E16BFE87F1FB12722086DD3647F3650031F72266D4C16118FF9233972B746897A7B3F4BDF5D0826FBD8E9C1F3077DC9C155324B16D96003085EE6C7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......[......T...T...TT..U...TT..U...TP..U...TP..U...TP..U...TT..U...TT..U...T...T...T..U...T..U...T..T...T..U...TRich...T................PE..L....3g...........!...".l.......... ...............................................K4....@A........................ ...t............0..............."..0/...@...;.....T...............................@............................................text....k.......l.................. ..`.rdata...e.......f...p..............@..@.data....$..........................@....shared.$.... ......................@....rsrc........0......................@..@.reloc...;...@...<..................@..B........................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tv_w32.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	362288
Entropy (8bit):	6.600580188701235
Encrypted:	false
SSDEEP:	6144:VAFcz4hAtmr5rMSKW7g+JZFUEEgwbGfQASFCQk4AOUo56Gt4mE2R:u+21Bvk+JZiEE/GfQpHj6mE2R
MD5:	048CC47BE05A3D22BB5019015F8286B1
SHA1:	E7D5836562B028763D107E8372B5914A7CEE35F2
SHA-256:	74C5FAB3BCC1542EF0A92D6EB54CBB72ECABA72D50A981B07A7104A18A1F12C9
SHA-512:	C51CC6E8CC23B0C36957E9E6F95C49F77D80468D38DDAE8A45FCF69A7AA7B62B2A754458F323A0D59DFD933E037527CB699AA8F7E618B14DDB611E5A2290603D
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........+.U.J...J...J...2...J...2...J...6...J...6...J...2...J...6...J...2...J...J..[J..u6...J..u6)..J...JA..J..u6...J..Rich.J..........................PE..L....3g..............."............p.............@.................................V.....@.....................................(....`...............X..0/...p..$1..0...T...............................@....................... ....................text............................... ..`.rdata..PH.......J..................@..@.data...l"... ......................@....didat.......P......................@....rsrc........`....... ..............@..@.reloc..$1...p...2...&..............@..B................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (console) x86-64, for MS Windows
Category:	dropped
Size (bytes):	612656
Entropy (8bit):	6.6296860228182775
Encrypted:	false
SSDEEP:	6144:e779BVP6hn9cQ9u/esIMyUXOR7nXxBFUOU8I/Ubzi2G6PpqBlgXAjR+UhGhsoS05:e7prP6hnyb7jeNx73F+Ai+AZsbseCiwu
MD5:	9F597B5EBB2EAB9E85E4B5BD1FEB27AE
SHA1:	0EA591E2A6541B012BB702F13D4A93E6E5AC8ACD
SHA-256:	136B724BF8A88AEAABF186E5F3617EDBBF090231C3047E1447D6A5261EA63684
SHA-512:	48B072A4952D953A9D136796A7CE191515DB352FA73503280A987205AB1CE7B8F2C4C7794C76014D28C019319CC8D00DDBF0D523FA1D55FC550AE13808EB2EF7
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......8Xy.\|9..\|9..\|9..7A..z9..7A...9..3E..\9..3E..r9..3E..u9..7A..p9..7A..q9..\|9...9...E..p9...E..}9...E..}9...E..}9..Rich\|9..........PE..d....3g.........." ..."............@...............................................7@....`A............................................t........................U...*..0/........... ..T...............................@............................................text............................... ..`.rdata..6...........................@..@.data...H1..........................@....pdata...U.......V..................@..@_RDATA..\....p......................@..@.shared.H...........................@....rsrc...............................@..@.reloc............... ..............@..B................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tv_x64.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	429360
Entropy (8bit):	6.403512694173202
Encrypted:	false
SSDEEP:	12288:7CvCVmlq3sJ0WyvoY9phDKTFVZodiMyhsw:7CqVmlq8rcoUp1KTHZgy
MD5:	C2569AFDF453FF8EDC35546C6CD99F25
SHA1:	AFBFF67E0DD01BB43804C2D861A3ED385BEEFC6E
SHA-256:	82DEB0B2CFD81447C6EF19CC8620793E143D0F7D543EEC4DB2939C29EED34ED1
SHA-512:	FBB0DB2DDFFDE7CDCAB2D5B0EA98A4D88AEF1000A6F5FD11650EFD3F3EDA3DF8D774E71DB0DC3946D1F98677272DA16484C7B8DD03D00598348722EC5FF21091
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........I...I...I...............F.......C.......D.......]...............J...I.........i....v.H...I...H......H...RichI...........PE..d.....3g.........."....".L...*......P..........@.....................................k....`.....................................................(............P..T3...^..0/..............T.......................(....~..@............`......d... ....................text....K.......L.................. ..`.rdata.......`.......P..............@..@.data...\|2..........................@....pdata..T3...P...4..................@..@.didat...............H..............@..._RDATA..\............J..............@..@.rsrc................L..............@..@.reloc...............R..............@..B................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\tvfiles.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	68012141
Entropy (8bit):	7.999996391476119
Encrypted:	true
SSDEEP:	1572864:7tHGL2imNGck9gTKQtEZjZjb914komphRDrGdXCl2EXTcAeUu:Jm3gtEZR4KfR/l2EeP
MD5:	6481BE826C6C0E4E5044B7AEFD798C8F
SHA1:	A158D4C2A009803D4AEA0F266B34CBB4AE65DCCD
SHA-256:	0E6C4D5CC07EE959F526295E79C56FE2ED8A8D1023F688555F1FB6F1A154D69A
SHA-512:	1640A148D63FA843D3B85BCD49A9AF3BE7358BF96A82B9032D557783785951647D1DCC290EC494A913E5B2E9BDD9897B3D71B1386EB3C2F7601243743A06074C
Malicious:	false
Preview:	7z..'....d.b(.......%.......y.C...`...Q....}.=m.u`...Ah3u.kv!.. Kg)...%.....ii....j..:0..Q.x~..".....y34~D..c...0..k.O..W.....G^....:].ce.#.q.$TzuW...h..'imfv.,UK...D;... (.l..z..A...5.y.4..........M.y...3.....)'......80ILrPF...@..bU.!.<.... .:o....^.T....-...^.Ytuq.. .WI.i.j.[.7.. s....H..<......./Ad3...p[..%Y,..2.s[.H6"..jF.7..e-.E.7T.....0....K./.MW../.6.l..<.k...2..(..f....t.Bv..~.m)...1....z.j.\|.v....5..ui.@_.~...>.@W..Y..qF.V..y..A.,@."......j....e].....A.t.1..1...SQ..g/.s.b.<D.).X6./.}UbYe.+.n.;..{....]...(....e.!R....h...G....S..CC..$f...N......m..{....e\/....I..\|n<.u...d..\|. .-3QjpY. oKu..H](........a....YRA.n.u..E..w.C~..d..`..xF..,.DK.#.t.e.._B8H\$.u.!lS...9-u@.3f......, ).Z....^...........8i-.........._..]..e...t.8......]....M.'.,+%....v....pFz>..q2..u%AV.O............5....Tm....:.f...PO>~......e..7O.,&8.....W.R.....<;.!a.e....KY3v..b..5........Pk...{.~O...R........B.F.m.G......h..f..=$k....4.._b7C2.....o.8.p...s...F.........

C:\Program Files\TeamViewer\TVExtractTemp\tvfiles_printer_WithPDFSupport_x64.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	364560
Entropy (8bit):	7.9995333112503495
Encrypted:	true
SSDEEP:	6144:ZF/r31fRSYFtbAtnX98TKt1f4ymTN0fvez0bMYJlcBHALHmULTk:ZFb1ftC6TKt1fWJqveobMYJlcBHuXLY
MD5:	113DE28B4DC4D132A53AACB43D88D064
SHA1:	927B206CB925D73D48E1D626B148453055748C40
SHA-256:	35641CACBEB210DD857F9CF3C8AD1AA81A74F8EDCDD2526BE07E16580C7EF08C
SHA-512:	92867E0914E4A1F06FB80D89E68E1EF0ABB4AF6EB4FAF302E05FF6DD21F46758AA8150BF2267F6DC052702FB9C99F055254A2F7CB5F6AF26F672119B729ADFFD
Malicious:	false
Preview:	7z..'....w-s.......$.......3......&....FnP..p<......o..:.D.y.2...;N...$.....R%.$.+.y.4N.T...I..!...W.iX.u..>c.......>....hU.}V...!E.......>1...`.........-\?.&S....9...A.(1.O[kOK..\|.a.=.`XK..%..9F.S8..\|.D=.5.b.z....]....?..........SV1.Pj.W.....z....<P....DU\..._7.Z..W..W..cL...Me..@j.0=]I.....Y...Va.J.Lu.)B.1.@+0...)e.....[.x."!.UX.........P!../7.$..."R.....j. 3.Pxp.W...JN...5../.?G9b.C..>...=y7. ..~TV.......T.y.......{#.Hm[k.x0..WB\|..=..7sY.f..t...fs...e...V!.g..6s./,n.D?..`.t..H...^jPv....>...]K./...,ej_..D,....T..)..h[##..i...'b...e......7.$.od'.5.K.K.V.G..[....CUn.Y.......J.....$...y.-J^....V.,...,.\../...g....:....i.kp8%..i....Y..x.....m..Ne..........~.i..+..G:B....#`.-^.+..%gS-L..P).Zz.....8.s........Bx.... ..>h.2...2..J....~l..G.z....).b.C.^Rtd.....s-.b..3:Hb.qXG...f.0 =.^...5..q.&.z.8.g....d.76.....&..==.....[]./0.....).:7P..y.w.F4...jr#..;.....*L>z.j.`Q...6.X.J.....6..R......b.........@.....9P.._..,..Y.c#+..I.bS.(.C..F..!

C:\Program Files\TeamViewer\TVExtractTemp\tvfilesx64.7z

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	7-zip archive data, version 0.3
Category:	dropped
Size (bytes):	310194
Entropy (8bit):	7.999382001365806
Encrypted:	true
SSDEEP:	6144:4S2ruVvp26RNW2ee98lcMXZ7cOxmFb4tFzaUNrDw394mV6L2JAyLw:auVEQW2r0cMlAB4tVaUJ+94mu
MD5:	846AF7A620836D57195ADBA6CB2F9327
SHA1:	AFE4FBF75BCAFE480997387F74633CB34D667290
SHA-256:	612A8D33CB8B6E5BAA0E9C91189C13873664DB0846B9FDFECB345961BD11CB5B
SHA-512:	C78B719A00AE1064EA62A2FF685069699166333678AD5D485B3982FBBDD685019B1B57EACD88133BDAFDD8D3FA1E7EB9F93E7BD3409ECFE686D24F95E4A8CAED
Malicious:	false
Preview:	7z..'....~.hn.......$.......r..+.. .(.....H.U......6.PXGp..F.5J..E=I..2..A/@.%....P)..H..Sp..u>=C..C...N).......(..."ZZS ....W..@[_f%...$..E!..a..B...v...L.'.`.~.b..F.._Rbc2......^.s..D@.?..8,z_S.xY...............YJ0gzd...J...jYl......DD.. .'M...C.....h~.6.....r...K?-.m..]."........5..Q5!b......7...^......s.....g2j.S.'.;.K.3'.s.=^b...)%2.'...~=...!...m>JmGS~D.......s...P..._...G...h...%..M......#.[.B...Y.N8..J,..H+O2.....d......R.Q..R.t.....qU.3i.[..z7...NcB>Tig...\K5.,.P4y....}..w.....j<..O9.....[A.-..]...L8.K..B..LT.H3.bF./.FaX...."wD..ss.N.I....7......]m,.m{.E.7b..6..R;Z..^Q....o{.+.)g.a.....C....\|.,...3...).xQ..}..D. ?........ H5..4X.r...K...X..u.H].o&..nU..E..a.T.$.....f....3...Vr/._;..Cw.`+..@&d..}..-;)..d1j q.t.S...Y%}[K....]:.sP........x.F.2NU%..<.>VE..9$_KP.....H.w.7......H...lg7.."^.`K0....8.....1........8t....F...}.i..N....i....S..^.`.g..42...:..`{.V..7...V...f..,...C.m04...I.j.d...h...D9.}.hPQ......Q.N2!..K.I..jB9.....x.q...;.....S

C:\Program Files\TeamViewer\TVExtractTemp\uninstall.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	1165840
Entropy (8bit):	6.419383926919195
Encrypted:	false
SSDEEP:	24576:Gnzn0vN6aSoGsZwXV22NNNKwhfmH5abENDcCBV:A0vSoGsZwXV2ExnbENDcC3
MD5:	E217DB9E269FF85272513E81B9F191B3
SHA1:	FA493446A28D9CC3B0578E7136068048E140134B
SHA-256:	43E868678463F759F4CE8EA235486B955EF6426977C869BDA308622E3D57855D
SHA-512:	5833DEF4E078D73196019318B62EC104DC1CC016E53599EC70785FFCD39A9A031244B066E21841429884EB0B02DC9762CFF7C4DDAA757A475F9C7F622A343E8F
Malicious:	false
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................d...........2............@.......................... .......f....@.............................................................0/...........................................................................................text...{c.......d.................. ..`.rdata...............h..............@..@.data...............~..............@....ndata...@...P...........................rsrc...............................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\utils\MicrosoftEdgeWebview2Setup.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1592616
Entropy (8bit):	7.928355704554102
Encrypted:	false
SSDEEP:	24576:Uwyf3Su4a/KnwYtDXl42hxt3q7lR3hVtTcKaBQ7SdBZpeUY:Zyf3L4aGweXl1h/C3Jc9BQ7SdPMh
MD5:	B32D72DAEEE036E2B8F1C57E4A40E87A
SHA1:	564CAA330D077A3D26691338B3E38EE4879A929D
SHA-256:	65F6EFDF6DF4095971A95F4BF387590AE63109388344632A22458265AB7DD289
SHA-512:	B5D62CE1462D786C01D38E13D030AD6236CE63321819CF860CC6169F50F6309E627BC7709B305422851779E37DBAE9FB358008AAD8D6C124CD33CDEC730288D5
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......d..[ e.. e.. e..4...+e..4....e..B...1e..B...4e......-e..B....e..4...3e..4...!e..4...-e.. e...e....@.!e.. e(.ve......!e..Rich e..................PE..L....(.c.....................t...... }............@..........................p......m.....@..................................?..x.......................(/...P.. ....1..p....................1..........@...............H...T>..`....................text...*........................... ..`.rdata..............................@..@.data...,....P.......8..............@....didat..,....p.......B..............@....rsrc................D..............@..@.reloc.. ....P......................@..B................................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	5.282965170818026
Encrypted:	false
SSDEEP:	48:+vsh8Q2XFbsf0z6Joq7mgHwuMgHPgHxGFWlFVfXj/g:+vM4QI6JoimIMsCGFWlFZE
MD5:	5C05880E0ED65FAC3A4DFB7B6802B898
SHA1:	55EA8DAC7093123E26584A49012517818C0F586D
SHA-256:	60FA2925C589AC38BAB74713E1B0BB2A205A8C825D614B971FC3426991CD86CA
SHA-512:	5176504DE06E6F8249815F8F8472ED7C9A26003E92ECD80299DA8B611A630A1BA8179419CDF50F02B78A19CAF221D6E0AE59452B224DC55FEEF72A93CD4D147D
Malicious:	false
Preview:	; Copyright 2010 TeamViewer GmbH All rights reserved...[Version]..Signature="$WINDOWS NT$"..Class=Monitor..ClassGUID={4d36e96e-e325-11ce-bfc1-08002be10318}..Provider= TeamViewer GmbH..DriverVer=02/01/2017,1.02.0000..CatalogFile=TVMonitor.cat....[SourceDisksNames]..3426 = %SourceName%....[SourceDisksFiles]..TVMonitor.sys = 3426....[DestinationDirs]..DefaultDestDir = 10..MonitorFunction_Files_Driver = 12....[Manufacturer]..%MfgName% = Driver_Mfg,NTAMD64....[Driver_Mfg.NTAMD64]..%Driver_DeviceDesc%=Driver_DDI, *PNP09FF....[Driver_DDI.NT]..CopyFiles=MonitorFunction_Files_Driver....[Driver_DDI.NT.Services]..Addservice = MonitorFunction, %FLG_ADDREG_NOCLOBBER%, MonitorFunction_Service....[MonitorFunction_Service]..DisplayName = %MonitorFunction_SvcDesc%..ServiceType = %SERVICE_KERNEL_DRIVER%..StartType = %SERVICE_DEMAND_START%..ErrorControl = %SERVICE_ERROR_NORMAL%..ServiceBinary = %12%\TVMonitor.sys..LoadOrderGroup = Extended Base....[MonitorFunction_Files_Driver]..TVMonito

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVMonitor.sy_

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	18336
Entropy (8bit):	6.275348584247018
Encrypted:	false
SSDEEP:	192:qumQmspn15C9l0HDRRdrauc056CAyIKGNsuIeInYe+PjPtrwnc8ijtlAur9ZCsp5:qmF100Hzdrau/NAyoauQnYPLWUUHeMt
MD5:	B7CA6668278FBAE3FBD649285F8CCC35
SHA1:	DD5CD2FB0E6818EB56268F0D6E72D0F5AC74AEF4
SHA-256:	78318C6A8AE65FB3AFE6BA06CF1BDA69903390E250950D3BF78895CD79AFD4D8
SHA-512:	7305B979ABBEF7BEB4789261E9FC0EBDE00415BB00ECEEE2289CD1FCF91467CCC7C84ED77E7F5CD042243508B5FC8C3384EA59D6A1A17497781110FE5238103C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........D..S%.S%.S%.S%.s%.Z]I.P%.Z]O.Q%.Z]Y.W%.Z]P.R%.Z]N.R%.Z]K.R%.RichS%.................PE..d...)x.Y..........".................d`.......................................................................................................`..(....p.......@.......(...............!............................................... ...............................text............................... ..h.rdata..t.... ......................@..H.data... ....0......................@....pdata.......@......................@..HPAGE....z....P...................... ..`INIT....x....`...................... ....rsrc........p.......$..............@..B........................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	11393
Entropy (8bit):	7.262775900557745
Encrypted:	false
SSDEEP:	192:qtxI5sxyQJCxSFBkyKuqwFWQFH5JUoowcLK+X01k9z3A4ZdMXrWp:80GFRdfUo6R9zrvMu
MD5:	746441B276B24B7A5B487A429F60D214
SHA1:	657258CBAF47D6FAA2EC58C77B948C6398828F96
SHA-256:	2C714A3687424C798B565128C0720322A7EA0FB779D91963048394EA471707AA
SHA-512:	F734829EC6D6AD84848FA5CD2B866337360481B596A383A49AE3BA5176FFD74850C8DFA345F1DD3BC4644DA6FA905AD91644E450DA02C413D39849EA3C35753C
Malicious:	false
Preview:	0.,}..*.H........,n0.,j...1.0...`.H.e......0.....+.....7......0...0...+.....7.....<.O....E.L........240125134120Z0...+.....7.....0...0..'. `.........5.[.}.....t..oB.....1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6t.v.v.i.r.t.u.a.l.m.o.n.i.t.o.r.d.r.i.v.e.r...d.l.l...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... `.........5.[.}.....t..oB.....0.......@i...E@8z!:D^ze./1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6t.v.v.i.r.t.u.a.l.m.o.n.i.t.o.r.d.r.i.v.e.r...i.n.f...0.....]..n..\|...{.;....n.1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0X..+.....7...1J0H...F.i.l.e.......6t.v.v.i.r.t.u.a.l.m.o.n.i.t.o.r.d.r.i.v.e.r...d.l.l...0.... .^......%f..u`.c.l.IJ...5d.x.o.A1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+.....7.......010...`.H.e....... .^......%f..u`.c.l.I

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	72056
Entropy (8bit):	6.655826001710673
Encrypted:	false
SSDEEP:	768:Mdq9xYKLIHVgKqnS/OLlGkQctwE/uf95v13d6YHU3/Yic5Hf+AMxkEBsF9zmGW:MUYK7xxacKYS5vBHU3/7IHkxuXznW
MD5:	5DA3DD0A7761D1C1678D65F22005175A
SHA1:	13EDDA1695D1080379ADF30596F149CFE09E865D
SHA-256:	CD858C1A37D9599181285CE55E38BBD7CEF8637F8DF1D3BA425B78C2670E345E
SHA-512:	54C14B06F3CF373DD4A6D77030D7908FC6CB42BF151760877EF2EA0C5662B56F2DD09A334BB55602A4F1920CDF91FBA140AAEA14113DA369CD25B89AB8B3CA3A
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......3t..w.a.w.a.w.a.%`e.~.a.%`b.q.a.%`d.T.a.gd.v.a.~m..e.a.g`.r.a.w.`.4.a.gf.u.a.gb.u.a.ge.u.a.`d...a.`a.v.a.`c.v.a.Richw.a.........PE..d....6.e.........." .....v...R......@>...............................................%....`A........................................0...`...............................xU.............8...............................8............................................text....t.......v.................. ..`.rdata..R7.......8...z..............@..@.data...............................@....pdata..............................@..@_RDATA..............................@..@.reloc..............................@..B........................................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\TVVirtualMonitorDriver.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	4640
Entropy (8bit):	3.7271215593412443
Encrypted:	false
SSDEEP:	96:Kw/Pg6KAXlFHmk9/BabDIWebYNnitU42S42Lx:s1E
MD5:	6CCC14F0F72BB4398F0A15CC96BBBB86
SHA1:	891A0A4069C8CCEC4540387A213A445E7A65982F
SHA-256:	F35E1BED01D9EFDD2566F6A07560D263CE6CD9494AED03CD3564A7788F6FFA41
SHA-512:	1EF640FEC7F68587E938646AB2771F5BFA8384542E401B097CFCE3A0D0B67A3F5A6F756FC9F66C77D7D8AC6DAA87D227864E7B44FC81A64BEBC42254DEE906EE
Malicious:	false
Preview:	..;.....;. .T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r.D.r.i.v.e.r...i.n.f.....;.........[.V.e.r.s.i.o.n.].....P.n.p.L.o.c.k.D.o.w.n.=.1.....S.i.g.n.a.t.u.r.e.=.".$.W.i.n.d.o.w.s. .N.T.$.".....C.l.a.s.s.G.U.I.D. .=. .{.4.D.3.6.E.9.6.8.-.E.3.2.5.-.1.1.C.E.-.B.F.C.1.-.0.8.0.0.2.B.E.1.0.3.1.8.}.....C.l.a.s.s. .=. .D.i.s.p.l.a.y.....C.l.a.s.s.V.e.r. .=. .2...0.....P.r.o.v.i.d.e.r.=.%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.....C.a.t.a.l.o.g.F.i.l.e.=.T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r.D.r.i.v.e.r...c.a.t.....D.r.i.v.e.r.V.e.r. .=. .0.1./.2.5./.2.0.2.4.,.1.1...2.4...5.4...2.8.4.............[.M.a.n.u.f.a.c.t.u.r.e.r.].....%.M.a.n.u.f.a.c.t.u.r.e.r.N.a.m.e.%.=.S.t.a.n.d.a.r.d.,.N.T.a.m.d.6.4.........[.S.t.a.n.d.a.r.d...N.T.a.m.d.6.4.].....%.D.e.v.i.c.e.N.a.m.e.%.=.T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r._.I.n.s.t.a.l.l.,. .R.o.o.t.\.T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r._.I.n.d.i.r.e.c.t.D.i.s.p.l.a.y.....%.D.e.v.i.c.e.N.a.m.e.%.=.T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r._.I.n.s.t.a.l.l.,. .T.V.V.i.r.t.u.a.l.M.o.n.i.t.o.r._.I.n.d.i.r.

C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewerVPN.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5852
Entropy (8bit):	4.8898985616021315
Encrypted:	false
SSDEEP:	96:q2i3bD2JlgdmibjR+iAz4C7bZ7xTMPTtQ2rtu3DcNSjXKjvKY8kz7s7wfQTXvMYk:ri3WJlgdmibjR+iAUC7bQPu6o3DcNSju
MD5:	65FA1C2E7127E7B7D42A712574BE0877
SHA1:	2BEA89F8A0D9A867C6BB7711F51ECB7ECDB0F988
SHA-256:	07C7CFF907E6BCC9C3B587728C055DF6DE9F5089AC1C4BAB4014A8993A5FF788
SHA-512:	27BDC76B443DABC72FE7EA9338716B3BD4520858A2CB40BB4F4C00E1FA423F3A2FD339E305C68A81AC8474B794FE8BA5AC7DD07FDC9FBAE52D48E2AC37DB5874
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2021 TeamViewer Germany GmbH ..; ***************************************************************************....[Version].. Signature = "$Windows NT$".. CatalogFile = teamviewervpn.cat.. ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}.. Provider = %Provider%.. Class = Net....; This version number should match the version..; number given in ..\version.m4... DriverVer = 10/08/2020,9.24.6.601....[Strings].. DeviceDescription = "TeamViewer VPN Adapter".. Provider = "TeamViewer Germany GmbH"....;----------------------------------------------------------------..; Manufacturer + Product Section (Done)..;----------------------------------------------------------------..[Manufacturer].. %Provider% = teamviewervpn, NTamd64....[teamviewervpn.NTamd64].. %DeviceDescription% = teamviewervpn.ndi, root\teamviewervpn ; Root enumera

C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	11460
Entropy (8bit):	7.27311231791528
Encrypted:	false
SSDEEP:	192:6F7Y/7MMMyECxPpramyKQFWQFN4p7El+X01k9z3ApdzO4:dg4h8FR7oY+R9z6p
MD5:	7BDE799A1F3A2D770E132E646DCB7FBE
SHA1:	D8FA17ADFB97E97F7604BCDA40B3B0A3AA3A17FA
SHA-256:	9A3039C3D44BAF9B38302C73F5D1EDEF209A6A56E3A4BB1BE325479C1883C4F9
SHA-512:	0FD462F2D6DC3DFB18F83EE235207C8B435D2D4A3BFBB51CEC04D3CF12B57068F130D9494D1AF5034AA9E89B8268EC334D8F61171F2BB62CD7B254CF0FB0FF7C
Malicious:	false
Preview:	0.,...*.H........,.0.,....1.0...`.H.e......0.....+.....7......0...0...+.....7......,.c.w)K....Z..^..231018055851Z0...+.....7.....0...0..7. \..P....W8..oY.C.Dd.~...QT..5m<1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0]..+.....7...1O0M0...+.....7...0...........010...`.H.e....... \..P....W8..oY.C.Dd.~...QT..5m<0h..+.....7...1Z0X...F.i.l.e.......Ft.e.a.m.v.i.e.w.e.r._.v.i.r.t.u.a.l.d.e.v.i.c.e.d.r.i.v.e.r...d.l.l...0....{.j.......H..N.E..:1..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0h..+.....7...1Z0X...F.i.l.e.......Ft.e.a.m.v.i.e.w.e.r._.v.i.r.t.u.a.l.d.e.v.i.c.e.d.r.i.v.e.r...d.l.l...0.....a.]QI,.A..Te.W.H..71..0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0h..+.....7...1Z0X...F.i.l.e.......Ft.e.a.m.v.i.e.w.e.r._.v.i.r.t.u.a.l.d.e.v.i.c.e.d.r.i.v.e.r...i.n.f...0../. .!e..W....^.b.&..~Q;.......#}..1...0...+.....7...1...04..+.....7...1&0$...O.S.A.t.t.r........2.:.1.0...0...0U..+.....7...1G0E0...+...

C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (DLL) (GUI) x86-64, for MS Windows
Category:	dropped
Size (bytes):	604952
Entropy (8bit):	6.471942712240294
Encrypted:	false
SSDEEP:	12288:FKt/PGMjuTxFzMp25O5sXwYTSaqU6LwonnRDt8:FiGDIKAYTSaRfunRDi
MD5:	A380586D76C8AC7D594FCC584D3EB3D5
SHA1:	67B07EB2B6DE9BBE2485A5B9075218DC70752388
SHA-256:	816DEFEC7889C3B4F69D253492402E2E3D0F0016CD5A22136828D5B60A2AA33E
SHA-512:	14D09A692964202300D71506E2741A46EB8BB2A54332E2B370AFDE3B5021DB2DC06737718D6EAFC680DD05BCD130872B5EC860CB80EB2BE3C2910B7B2536F306
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........;...Z...Z...Z..."...Z..."..*Z..."...Z...&...Z...&...Z...&...Z..."...Z...Z..PZ..."...Z..I&...Z..I&...Z..I&...Z..Rich.Z..................PE..d...r.'e.........." ...".h..........................................................xY....`A.........................................W..h...8X..<...............tX.......U.............8.......................(...0...@...............H....T.......................text....f.......h.................. ..`.rdata...............l..............@..@.data........p...$...T..............@....pdata..tX.......Z...x..............@..@.didat.......`......................@..._RDATA..\....p......................@..@.reloc..............................@..B................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\TeamViewer_VirtualDeviceDriver.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	2420
Entropy (8bit):	5.324223103982517
Encrypted:	false
SSDEEP:	48:x+FhiEAMeGZIVsomMGVWtbAM62fUifVwqgPbKJn0Fjeu70Fpn0Fpa70FLe4CAo0f:x+zinSZIVstMXtsM62fUif1gGJ0Ku704
MD5:	7A630E28A84F90884018048A034D3AB4
SHA1:	B661B95D51492CE7410ADC5465E157FE48A7C837
SHA-256:	FD2165838357E9FE0BCA5EBB621326950F7E513B9E85A2ABE8A5D006237D8317
SHA-512:	EA566268AE74FDF9A930442DAFE415A9FFCD892B9E1EF4A43D3BCA9862CD5FAD23A8CEE5CE7AD11C242CF1183FA4BD2F5E6FC93BE1D8789F4D92579E2FD89F6E
Malicious:	false
Preview:	;..; TeamViewer_VirtualDeviceDriver.inf..;....[Version]..Signature="$Windows NT$"..Class=System..ClassGuid={4d36e97d-e325-11ce-bfc1-08002be10318}..Provider=%ManufacturerName%..CatalogFile=TeamViewer_VirtualDeviceDriver.cat..DriverVer = 10/12/2023,9.33.58.52..PnpLockDown=1....[Manufacturer]..%ManufacturerName%=Standard,NTamd64....[Standard.NTamd64]..%DeviceName%=Device_Install, root\TVVirtualSmartCardReader....[SourceDisksFiles]..TeamViewer_VirtualDeviceDriver.dll=1....[SourceDisksNames]..1 = %DiskName%....; =================== UMDF Device ==================================....[Device_Install.NT]..CopyFiles=UMDriverCopy..Addreg=LogParams_AddReg....[Device_Install.NT.hw]....[Device_Install.NT.Services]..AddService=WUDFRd,0x000001fa,WUDFRD_ServiceInstall....[Device_Install.NT.CoInstallers]..AddReg=CoInstallers_AddReg ....[Device_Install.NT.Wdf]..UmdfService=TeamViewer_VirtualDeviceDriver,TeamViewer_VirtualDeviceDriver_Install..UmdfServiceOrder=TeamViewer_VirtualDeviceDriver..UmdfMethodNei

C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\TeamViewerVPN.inf

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Windows setup INFormation
Category:	dropped
Size (bytes):	5391
Entropy (8bit):	4.832043523407305
Encrypted:	false
SSDEEP:	96:s2iQJD2WlsdGebjR+iAz4C7bZ7xpRStQ2rtu3DcNSjXKjvKY8ks7nuwfQTXv/zof:FiQQWlsdGebjR+iAUC7bpR6o3DcNSj6e
MD5:	447FC733747DB11CD4492AE01C5652FE
SHA1:	2A70DCD391464CB8D3736322E07E966E105D396E
SHA-256:	A817B0E8A669D5ACAF2DDFBC95ACF2A1213B092B44DC896A0EE4A5301D06EBC3
SHA-512:	238099DB072AF55445D421E941944ABE8A6F52A124A26CAE84C1DD52FFFAFC4DAC5586D0C7407B461CD0DB8E771E1DBB6CA34AEE84581B24347F401410B2AFE5
Malicious:	false
Preview:	; ***************************************************************************..; Copyright (C) 2007 TeamViewer GmbH.. ..; ***************************************************************************......[Version].. Signature = "$Windows NT$".. CatalogFile = teamviewervpn.cat.. ClassGUID = {4d36e972-e325-11ce-bfc1-08002be10318}.. Provider = %Provider%.. Class = Net.. DriverVer=11/27/2007,2.10.00.0000....[Strings].. DeviceDescription = "TeamViewer VPN Adapter".. Provider = "TeamViewer GmbH"....;----------------------------------------------------------------..; Manufacturer + Product Section (Done)..;----------------------------------------------------------------..[Manufacturer].. %Provider% = teamviewervpn,NTamd64....[teamviewervpn.NTamd64].. %DeviceDescription% = teamviewervpn.ndi, teamviewervpn....;---------------------------------------------------------------..; Driver Section (Don

C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	10645
Entropy (8bit):	7.272624114612594
Encrypted:	false
SSDEEP:	192:H64PyG0o6orbfUG3afdjIafdjShjFivhE:jnrbVafdjIafdjcjFiJE
MD5:	5CFFE65F36B60BC151486C90382F1627
SHA1:	F2A66EAE89B4B19D4CAB2AC630536AF5EEEEF121
SHA-256:	AA7C09A817EB54E3CC5C342454608364A679E231824F83BA5A2D0278EDCC1851
SHA-512:	1BD48EF66F8714E7E9591043D03BD69A30881ED3D0F2463B15750A3282DF667FFB076B3A92358EECEDAE0E54485B07D702667E8FE0AF64C52BE04DB47145920B
Malicious:	false
Preview:	0.)....H........).0.)~...1.0...+......0.....+.....7......0...0...+.....7.....^FZ..t.K.........071228163009Z0...+.....7.....0..^0....R2.A.7.0.D.C.D.3.9.1.4.6.4.C.B.8.D.3.7.3.6.3.2.2.E.0.7.E.9.6.6.E.1.0.5.D.3.9.6.E...1..O0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...i.n.f...0a..+.....7...1S0Q0,..+.....7........<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+........p..FL..sc".~.n.]9n0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R8.7.C.A.9.7.9.F.2.2.A.E.3.2.A.2.6.8.5.5.1.C.A.1.9.6.2.C.D.9.5.2.F.D.E.2.3.8.6.9...1..W0>..+.....7...100....O.S.A.t.t.r........2.:.5...2.,.2.:.6...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...s.y.s...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0i..+.....7...1[0Y04..+.....7...0&..... .....<.<.<.O.b.s.o.l.e.t.e.>.>.>0!0...+...........".2.hU...,.R..8i...L0..H0

C:\Program Files\TeamViewer\TVExtractTemp\x64\VPN_Win7\teamviewervpn.sy_

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	35112
Entropy (8bit):	6.279693420486803
Encrypted:	false
SSDEEP:	768:/a/ZSDKMhnknetMdlHJRXz0yjSDomtN6l5cJQGftSSXakqEqLXb9:C/ZWnkn0uTRXz00Ss1m1YvEq/9
MD5:	F5520DBB47C60EE83024B38720ABDA24
SHA1:	BC355C14A2B22712B91FF43CD4E046489A91CAE5
SHA-256:	B8E555D92440BF93E3B55A66E27CEF936477EF7528F870D3B78BD3B294A05CC0
SHA-512:	3C5BB212467D932F5EAA17A2346EF8F401A49760C9C6C89C6318A1313FCBABB1D43B1054692C01738EA6A3648CC57E06845B81BECB3069F478D5B1A7CBCB0E66
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........mN... ... ... ...... ...N... ...!... ...[... ...]... ...M... ...Q... ...\... ...X... .Rich.. .........................PE..d.....`G.........."......Z..........................................................\|......................................................0...<....................t..(...........0q...............................................p..(............................text....P.......R.................. ..h.rdata.......p.......V..............@..H.data...x............`..............@....pdata...............b..............@..HINIT.................f.............. ....rsrc................n..............@..B.reloc..<............r..............@..B................................................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	10136
Entropy (8bit):	7.111963563245086
Encrypted:	false
SSDEEP:	192:xpkA4I/yo2JC6vyyKwnsFWQF3lrIzLMmDWqnajKs57wczb:J52lrnsFRJlrEQmDWlGs53
MD5:	87F9F85E95F9FBE3846E145CEC886E42
SHA1:	BAA55A0CFA3DBAAC1D082C4A2FEE1DA43DEABCF1
SHA-256:	CC2359A2FBF7962B3DF4D88D75A878A393F8C2694465D629F67593C107F94B0C
SHA-512:	D80DEC2C15FF05B9E6468BF5841BB024F48B0EB6822E932D65EED024B4A8FAE352AFE370E798CEE9AA2C06773E2163E849AF40B14C3B7D2C3657186F61278FBF
Malicious:	false
Preview:	0.'...*.H........'.0.'....1.0...`.H.e......0..u..+.....7.....f0..b0...+.....7.......~.?..A./:.d.)...211208152411Z0...+.....7.....0.. 0....R2.B.E.A.8.9.F.8.A.0.D.9.A.8.6.7.C.6.B.B.7.7.1.1.F.5.1.E.C.B.7.E.C.D.B.0.F.9.8.8...1..+0<..+.....7...1.0,...F.i.l.e........o.e.m.v.i.s.t.a...i.n.f...0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0E..+.....7...17050...+.....7.......0!0...+........+....g.w....~...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R7.9.9.D.C.6.4.0.E.9.9.5.E.4.2.7.5.6.B.D.C.2.E.5.9.3.9.A.7.0.4.1.3.D.6.5.4.A.2.3...1..=0@..+.....7...1200...O.S.A.t.t.r........2.:.6...0.,.2.:.1.0...0...0F..+.....7...1806...F.i.l.e.......$t.e.a.m.v.i.e.w.e.r.v.p.n...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........y..@..'V...pA=eJ#0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}........0...0J..+.....7....<0:.&.Q.u.a.l.i.f.i.c.a.t.i.o.n. .L.e.v.e.l.

C:\Program Files\TeamViewer\TVExtractTemp\x64\teamviewervpn.sy_

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32+ executable (native) x86-64, for MS Windows
Category:	dropped
Size (bytes):	46936
Entropy (8bit):	6.656488161316276
Encrypted:	false
SSDEEP:	768:XD0lMrZrZwFu/xdw9/oxBwNNyElQWmjI11YiWJ1hP4n2u41z2:6MT1ZyFoElQWAI11772H2
MD5:	6317A1890582D5ABB3E3E3EE6B217411
SHA1:	78F44D94212467FC61B98EFBDA91F2BC701E1A39
SHA-256:	3A09C3A24EC480BA4AD466760996E0F3CED30C1499ABDA32DA6EAD9DE5D08836
SHA-512:	6241DC81EF29736972D2E8CE3FE0C52371445CF80E5EBF22630D9F29B1953470A0F2C15A57262E400F90773EB74428AF4521C744ACFE7D202F19EBF9B7AE3E03
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........JF..+(.+(.+(.@..+(.@).+(.+).+(.@+.+(.@,.+(..^,.+(..^..+(..^*.+(.Rich.+(.........................PE..d..../La.........."......X.....................@..........................................`A....................................................<............p..T....v..XA...........R..8............................S...............P...............................text....=.......>.................. ..h.rdata.......P.......B..............@..H.data........`.......N..............@....pdata..T....p.......P..............@..HPAGE.................T.............. ..`INIT.................b.............. ..b.rsrc................n..............@..B.reloc...............t..............@..B................................................................................................................................................................................

C:\Program Files\TeamViewer\TVExtractTemp\x64\tvmonitor.cat

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	8881
Entropy (8bit):	7.27496797439638
Encrypted:	false
SSDEEP:	192:Ast9AnYe+PjPtrwnc8ijtlAur9ZCspE+TM4rwMcA0qTv0a:NAnYPLWUUHeM4cAVv0a
MD5:	1F2380A5474583DBA929F761A760546F
SHA1:	561248613C6F443D8A993900E2DBEBF3B718A660
SHA-256:	143DF27418B1EAF375BED6291765E2E77166830D6216A6BFB71A075735F05DA5
SHA-512:	4309403DF0A29C53190833AA13A6E67A4501650B77106BC62925F691DFFEDCAB184B6DF3B8BA750E0A8FD4C9B6E0919B729F5BD250413178CD7A4CE287241AED
Malicious:	false
Preview:	0."...*.H........".0."....1.0...+......0..\|..+.....7.....m0..i0...+.....7......i.&...E..l....N..170512092819Z0...+.....7.....0..F0....R2.9.6.0.7.A.C.D.0.3.F.6.4.A.B.F.5.2.3.9.8.B.F.3.D.E.0.4.E.8.1.9.D.1.A.0.8.C.3.4...1..K0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...s.y.s...0M..+.....7...1?0=0...+.....7...0...........0!0...+........)`z...J.R9........40V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.C.6.8.9.A.A.B.8.-.8.E.7.8.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}....0....R5.5.E.A.8.D.A.C.7.0.9.3.1.2.3.E.2.6.5.8.4.A.4.9.0.1.2.5.1.7.8.1.8.C.0.F.5.8.6.D...1..C0>..+.....7...100....F.i.l.e........t.v.m.o.n.i.t.o.r...i.n.f...0E..+.....7...17050...+.....7.......0!0...+........U.p..>&XJI.%....Xm0V..+.....7...1H0F...O.S.A.t.t.r.......02.:.5...1.,.2.:.5...2.,.2.:.6...0.,.2.:.6...1...0b..+.....7...1T0R.L.{.D.E.3.5.1.A.4.2.-.8.E.5.9.-.1.1.D.0.-.8.C.4.7.-.0.0.C.0.4.F.C.2.9.5.E.E.}.......0..0....+.....7......0.....O.S

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\lz3EbiqoK4.exe.log

Download File

Process:	C:\Users\user\Desktop\lz3EbiqoK4.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	388
Entropy (8bit):	5.20595142366915
Encrypted:	false
SSDEEP:	12:Q3LaJU2C9XAn10U29xtUz1B0U2uk71K6xhk7v:MLF2CpI329Iz52Ve
MD5:	2452328391F7A0B3C56DDF0E6389513E
SHA1:	6FE308A325AE8BFB17DE5CAAF54432E5301987B6
SHA-256:	2BC0F7D1CBD869EF4FD93B95495C8081B01B3FD627890B006B6A531D8C050AA2
SHA-512:	AC65283B0959E112B73160BB4322D0725C7D0EC79E3BB93555B1412204AA72F1F66BB9EB8D8B24B6570EC8717A1A4A129454588C3EA9ACE206B6E9CCB7F2ABDC
Malicious:	false
Preview:	1,"fusion","GAC",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System\bec14584c93014efbc76285c35d1e891\System.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\2cdaeaf53e3d49038cf7cb0ce9d805d3\System.Drawing.ni.dll",0..3,"C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\d0e5535854cce87ea7f2d69d0594b7a8\System.Windows.Forms.ni.dll",0..

C:\Users\user\AppData\Local\Temp\Client-built.exe

Download File

Process:	C:\Users\user\Desktop\lz3EbiqoK4.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	3266048
Entropy (8bit):	6.0837240941236725
Encrypted:	false
SSDEEP:	98304:bvk22SsaNYfdPBldt6+dBcjHwKRJ6JQa:TJ7jjM
MD5:	181719B653C83D0463D89A625A7F5C3E
SHA1:	1173005BE27979DC74779E60DC790299E4F2B0A4
SHA-256:	03A4B081B4966130CBE615FF249954E7E9A0D62A79FAF8E56AC3830929748E43
SHA-512:	D05E6FC586A8731903DF4CFFE3BDCB92F99E2CDBE15E40706E87ECC038E4E9B1EF1FC9A39F8ADEDA4341E3507F2F8F81AE50D590FF9F4233CD7694B26FB3FA04
Malicious:	true
Yara Hits:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: ditekSHen
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......d..................1...........1.. ........@.. .......................@2...........@...................................1.W.....2...................... 2...................................................... ............... ..H............text...4.1.. ....1................. ..`.rsrc.........2.......1.............@..@.reloc....... 2.......1.............@..B..................1.....H........................k..p............................................0..M....... ....(.....(...........s....(....(...........s....o....(.....(....s....(........0..8.......(....(0....s....%.o....%.o....%.o....(....&..&...(.............--..........00.......0..@........o....,7(....(0....s....%.o....%.o....%.o....(....&..&...(.............-5..........08......f~w...,.~....(....(.....v.(.....s....}.....s....}....r..(......(.....(......(....*....0..L........{....r...po....

C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe

Download File

Process:	C:\Users\user\Desktop\lz3EbiqoK4.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	72005560
Entropy (8bit):	7.999967414230672
Encrypted:	true
SSDEEP:	1572864:Ve9Md8ir5RcKqhxdJjHKO56/nMgt5LhZx5oZiJG2Ol40hi7iU:E2NdRTqhXJDLenHhZx+ZiJcl4n
MD5:	D15511E4B90CC6729FEDAF86D080D1F6
SHA1:	F793057F848979822C892AD135AF23C6B45EE15B
SHA-256:	F5BA0D0FAB79FAFF553D77B2BE94AD3B21D978AF62C716D580995978E2A316D6
SHA-512:	6661E262B9C0D2FFEE467F4503257FC3DE4736A47B805660315E813EE0523C5A1696628DC89B77EC2662E52D6D8EF069F9D9B0E91B51B7BDBF7FFD3916495341
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........(...F...F...F......F...G.v.F......F..v...F...@...F.Rich..F.........................PE..L....z.W.................^...........0.......p....@..........................`......?MK...@.................................(t..........hk............J.0/...........................................................p...............................text...[\.......^.................. ..`.rdata..F....p.......b..............@..@.data................v..............@....ndata.......@...........................rsrc...hk.......l...z..............@..@................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nse51FF.tmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	73450358
Entropy (8bit):	7.942447696919663
Encrypted:	false
SSDEEP:	1572864:AZQtHGL2imNGck9gTKQtEZjZjb914komphRDrGdXCl2EXTcAeUL:aAm3gtEZR4KfR/l2EeA
MD5:	8501B26923CBA585012B43C6E2ED1507
SHA1:	05B7FDAE45254680888186EF51A188C80903D7E9
SHA-256:	39C57507250071C76253592748EA2AA9ED19D370AD3F16FB73EBD78F34159564
SHA-512:	3FDB930BB02BFB803B88FF5A25D6DAE98450C476F4ABAEFC0157EE8B157DA462EB0AB0CE8B241C10C3F9F6627E72AE0981AFEFC1810349916EC3655197AE785A
Malicious:	false
Preview:	.b%.....,.......................<.......r1%.!....b%.....................................................~...................................................................................................................................................................................G...J.......................F.......y.......................................................................................................................%...............................................................................................................................D.......k..............................................j.......l...r...t..............................................................................................................................4.......................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\InstallOptions.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	27960
Entropy (8bit):	6.728473100924503
Encrypted:	false
SSDEEP:	384:E4C43tPegZ3eBaRwCPOYY7nNYXCT/YosaiZSf+VIYiWL3LU9Pxh8E9VF0NyzDcHF:ElTgZ3eBTCmrnNAho/YiWk9PxWEZsOe
MD5:	E87068563FC18E67A78230067CC240E5
SHA1:	37CD2CB5581FC575B8C46383D877926BDA85883B
SHA-256:	822F75B69DD87332B5995528771923EC74DC5329C65094BF4E372EB8EF42BB8E
SHA-512:	DAB6B330D73ABADB63F6EB02A5BC87CE9B9D1BC64FCB9289581CFC2E04BE0254893945B3BDB762B382BB491388E34BC018F098A489908DFBC9FECA2A9BA13D5D
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......N.px.q.+.q.+.q.+.q.+[q.+.~C+.q.+^R.+.q.+^R/+.q.+.w.+.q.+.Q.+.q.+Rich.q.+........PE..L....z.W...........!.........`.......+.......0......................................................................8......X1.......................>..8/......X....................................................0..X............................text............................... ..`.rdata..G....0......."..............@..@.data...DL...@.......,..............@....rsrc................6..............@..@.reloc..x............8..............@..B........................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\System.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23864
Entropy (8bit):	6.996623524463238
Encrypted:	false
SSDEEP:	384:58QIl975eXqlWBrz7YLOlACZSf+VIYiWLbLWQaZdPxh8E9VF0Ny0W3N9:5gPgrfYLOWJ/YiW8PxWE6Y9
MD5:	938C37B523D7FC08166E7A5810DD0F8E
SHA1:	47B9663E5873669211655E0010E322F71B5A94BE
SHA-256:	A91AA7C0EAD677FC01B1C864E43E0CACE110AFB072B76AD47F4B3D1563F4DC20
SHA-512:	77AFE83FB4E80A775DAE0A54A2F0FF9710C135F9F1CF77396BC08A7FE46B016A8C079B4FA612E764EEA5D258703F860688E38B443E33B1F980E04831739517C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....z.W...........!..... ...........'.......0...............................`......\|#...............................2.......0..P.......................8/...P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\TvGetVersion.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	713528
Entropy (8bit):	6.691023897960291
Encrypted:	false
SSDEEP:	12288:1vN6jZ0SoGsZwrbV22NJPNKwhtFXWKRc/VL5dAXfyud15bMVq03D:1vN6aSoGsZwXV22NNNKwhfmH5abEP
MD5:	41C3A6594060581D3BF1A16ED4AE6A72
SHA1:	62BDF8C2A3FA5F70E8B25E83C946DEBF80C8FD47
SHA-256:	E35396C7D7E32A8FE771895ED9EA16BD85C8544410BF4DC70A42CCD2884CFD83
SHA-512:	3FEE7EA74B4173B2815D631C8E69F5A21F2A170A46CE60424F9B9FB03CF7A35EAB6933210497F851816A1A85EB3FDB682781CCB5E2607B7ADE6DBC7A098368BD
Malicious:	false
Preview:	MZ......................@................................... ...........!..L.!This program cannot be run in DOS mode....$........E.;.$eh.$eh.$eh.Vfi.$eh.V`im$eh.Vai.$eh.Vdi.$eh.$dh\|$eh.Q`i.$eh.Qai.$eh.Qfi.$eh..Uh.$eh.Q`i.$eh.Qei.$eh.Q.h.$eh.$.h.$eh.Qgi.$ehRich.$eh........................PE..L......d...........!.........Z......>........................................ ...........@.........................P8.. ...p>..........@...............8/......pQ......T...............................@...............,............................text............................... ..`.rdata..............................@..@.data...LO...`.......B..............@....rsrc...@............\..............@..@.reloc..pQ.......R...b..............@..B........................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\UAC.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	30520
Entropy (8bit):	6.8630485708295605
Encrypted:	false
SSDEEP:	384:QqVibvTh4qnFP+OPEzinclP+RZSf+VIYiWLglLoPxh8E9VF0NyH5TV:QqVavVfPkzhlmg/YiWLPxWEFX
MD5:	488819F838ABFCAD73A2220C151292EE
SHA1:	4A0CBD69300694F6DC393436E56A49E27546D0FE
SHA-256:	B5BB8D301173C4DD2969B1203D2C7D9400BA3F7F2E34EE102905BD2724162430
SHA-512:	B00D6CF712FE4CEFCE41479F6E6F4AA5EA006694D10F2837204DE5BDE1C5A4BEF1368F2B0EB4B66D57A66E8CE6DC335FA91E9C8017E8E125C27EB1F5DF4DE9A0
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......DH.".)lq.)lq.)lq.)mqP)lq.!1q.)lq./jq.)lqT.]q.)lq..hq.)lqRich.)lq........................PE..L...lKPJ...........!.....4...........:.......P.......................................................................B..J....:..x....`...............H..8/...p..........................................................L............................text...Z3.......4.................. ..`.data........P.......8..............@....rsrc........`.......@..............@..@.reloc.......p.......B..............@..B........................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\UserInfo.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	16184
Entropy (8bit):	6.9836578650009375
Encrypted:	false
SSDEEP:	192:hxvcecjqZSF8VG+VIYiYF8u7a7JV+A0MLyfP+noPOJB3hy2sE9jBF0NyH0lQkzkT:QrWZSf+VIYiWLyLvPxh8E9VF0NyHka
MD5:	77FF6A927940A0E4B8DC07BDDE6AB5DB
SHA1:	8D0035242289504D050D237F7E3E548C1DDFF077
SHA-256:	E1CB80A23786B02CB2C6A2F9E391B63CBF3AD911E42BBDC14CC6879C84B7404E
SHA-512:	6A3050DC8E3F4EAAA85A43CDF1AC4F69745C07EFE48268103EE7D8927EC574B6866740F95E6B3AFF154BA74CD05024223A3EA4957CB773DD065CFD797F8A07E3
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......K..................[.........Rich..........................PE..L....z.W...........!................j........ ...............................P......_............................... "......L ..<.......................8/...@..p.................................................... ..L............................text............................... ..`.rdata....... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\advanced_unicode.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1332
Entropy (8bit):	3.6031642286014898
Encrypted:	false
SSDEEP:	24:Q+soqioC/irl1vSCm6a/gC863pXH/aKCo6sSljRF3Cb6LlTQ8CC6Llfnq84RUv:rs4Yx1vEFhaoWXrEJfq86a
MD5:	F68824A4130EBAF6BC7AB0F62256D7D7
SHA1:	40AF19A0D92B3C9E1A8B1EAAB7D12C69E5DF436A
SHA-256:	CD8149A2E89373075EE6DB800B7F2496BACBFE21B23E4A06A3453632503B3965
SHA-512:	6A173AAA183BE0E5A516CAD484802DAE1FC53A414F870F93EA846A9EF9F9DF35153766EF632EB5E8CED8F94C2ED09A9DECDF3465D46B0DCC44A6918D88E242CB
Malicious:	false
Preview:	..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.6.....R.T.L.=.0.........[.F.i.e.l.d. .2.].....T.y.p.e.=.T.e.x.t.....L.e.f.t.=.1.0.....T.o.p.=.1.4.....R.i.g.h.t.=.1.7.3.....B.o.t.t.o.m.=.2.6.....S.t.a.t.e.=.C.:.\.P.r.o.g.r.a.m.m.e.\.T.e.a.m.V.i.e.w.e.r.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.0.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.7.....T.e.x.t.=.D.e.s.t.i.n.a.t.i.o.n. .d.i.r.:.........[.F.i.e.l.d. .3.].....T.y.p.e.=.B.u.t.t.o.n.....L.e.f.t.=.1.8.9.....T.o.p.=.1.2.....R.i.g.h.t.=.2.6.9.....B.o.t.t.o.m.=.2.7.....T.e.x.t.=.B.r.o.w.s.e...........F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .4.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.3.6.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.4.5.....T.e.x.t.=.I.n.s.t.a.l.l. .T.e.a.m.V.i.e.w.e.r. .P.r.i.n.t.e.r. .D.r.i.v.e.r.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .5.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.5.5.....R.i.g.h.t.=.2.9.6.....B.o.t.t.o.m.=.6.4.....T.e.x.t.

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\finish_unicode.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	1264
Entropy (8bit):	3.530715965349217
Encrypted:	false
SSDEEP:	24:Q+soh1v05h6KPlUwmCX6sXxoByx2/uwmpCG6sULAQl6R5wJCD6sUqQ8lICx/L1:rss1vqDUwrXxRxMuwM+AQowQtICxT1
MD5:	DB0713808219E4D7334171F9E1E6C2BC
SHA1:	8D8C463837CFCE60B6F501DD75B398E3C7ED8A06
SHA-256:	51B57CF2C70006646A76797CADAA5D014C9FF707DA8A4B4E17BCDFCCC3C00FD8
SHA-512:	EF0F8FF01E4F6419BC64AF3A0FADADA15F0C1F23F95A544460DD4FAC83C1DDE3758537FD5F93CC8E3B39A45B310261B3F6511A286D95EE5EDF615EC40AAC08AF
Malicious:	false
Preview:	..[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.5.....R.T.L.=.0.........[.F.i.e.l.d. .1.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.5.....T.o.p.=.2.0.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m. .=. .3.0.....T.e.x.t.=.H.o.w. .d.o. .y.o.u. .w.a.n.t. .t.o. .u.s.e. .T.e.a.m.V.i.e.w.e.r.?.........[.F.i.e.l.d. .3.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.5.5.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.7.1.....T.e.x.t.=.I. .w.a.n.t. .t.o. .t.e.s.t. .t.h.e. .c.o.m.m.e.r.c.i.a.l. .f.e.a.t.u.r.e.s. .w.i.t.h. .a. .f.r.e.e. .1.4.-.d.a.y. .c.o.m.m.e.r.c.i.a.l. .t.r.i.a.l.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .4.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.7.1.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.8.7.....T.e.x.t.=.I. .w.a.n.t. .t.o. .u.s.e. .t.h.e. .f.r.e.e. .v.e.r.s.i.o.n. .f.o.r. .p.e.r.s.o.n.a.l. .u.s.e.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.........[.F.i.e.l.d. .5.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5...

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\ioSpecial.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	546
Entropy (8bit):	3.6508440945342078
Encrypted:	false
SSDEEP:	6:Q+slAm+fpIKiieXtAP9IHauQl33CslECmsCpi8lnMm2RKUEZ+lX1Adh5LlcTcpi4:Q+samuIfHaHNCsgsSaJRKQ1A1LJpDTV9
MD5:	C88548FDD55F5A5E167E1C132F4DE195
SHA1:	A442E688004013CB231D5EC6DDC8584509734623
SHA-256:	98C2A4A38AB29121852083E9FAC79712EACE125791FBEB7FC3971313649C05F9
SHA-512:	2B75786EAC4782D28844204A4AE8C8EAD9DA554A34DF25A564D87307691319E43417E61B27D14C36776A2ED245B27653AFD470B0FF83CB9208A5F9BEADE95131
Malicious:	false
Preview:	..[.S.e.t.t.i.n.g.s.]...R.e.c.t.=.1.0.4.4...N.u.m.F.i.e.l.d.s.=.3...R.T.L.=.0.....[.F.i.e.l.d. .1.]...T.y.p.e.=.b.i.t.m.a.p...L.e.f.t.=.0...R.i.g.h.t.=.1.0.9...T.o.p.=.0...B.o.t.t.o.m.=.1.9.3...F.l.a.g.s.=.R.E.S.I.Z.E.T.O.F.I.T...T.e.x.t.=.C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.n.s.p.5.2.D.B...t.m.p.\.m.o.d.e.r.n.-.w.i.z.a.r.d...b.m.p.....[.F.i.e.l.d. .2.]...T.y.p.e.=.l.a.b.e.l...L.e.f.t.=.1.2.0...R.i.g.h.t.=.3.1.5...T.o.p.=.1.0...[.F.i.e.l.d. .3.]...T.y.p.e.=.l.a.b.e.l...L.e.f.t.=.1.2.0...R.i.g.h.t.=.3.1.5.....

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\linker.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	58168
Entropy (8bit):	6.650537239673466
Encrypted:	false
SSDEEP:	768:ZmTLl3rmEgLMP/rLqgidfwHJQDEExmE+Ji4RdVt//wf/YiWGoPxWEfQy:ZgLFm8OdfwpJS/fqt//wf/70Pxf
MD5:	B05A97BB3F532B7CF57B8EEDF198D7AF
SHA1:	83C13A90F4A3C1C62E132F5F3BC70C97C2ECFC80
SHA-256:	7817F79BCDF54EF8617F15B5C0B9B92053549D5A51FA280722EE7179311B69A1
SHA-512:	40706C5FC72198148962D24046722FC5E488C0CC4B3374A9F4B652175919E97A8712E882940DB8C26479619A26EC4E2D41744627A9CA52EC7CB1CE4F91D7EE8C
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........6e..X6..X6..X6...6..X6..Y6..X6.X.6..X6..%6..X6..66..X6..56..X6.."6..X6..$6..X6.. 6..X6Rich..X6........PE..L......Q...........!.....n...N.......................................................O.................................d......d.......x...............8/.............................................@............................................text....m.......n.................. ..`.rdata..4........ ...r..............@..@.data...............................@....rsrc...x...........................@..@.reloc..............................@..B................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\modern-wizard.bmp

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PC bitmap, Windows 3.x format, 164 x 314 x 4, image size 26376, resolution 2834 x 2834 px/m, cbSize 26494, bits offset 118
Category:	dropped
Size (bytes):	26494
Entropy (8bit):	1.9568109962493656
Encrypted:	false
SSDEEP:	24:Qwika6aSaaDaVYoG6abuJsnZs5GhI11BayNXPcDrSsUWcSphsWwlEWqCl6aHAX2x:Qoi47a5G8SddzKFIcsOz3Xz
MD5:	CBE40FD2B1EC96DAEDC65DA172D90022
SHA1:	366C216220AA4329DFF6C485FD0E9B0F4F0A7944
SHA-256:	3AD2DC318056D0A2024AF1804EA741146CFC18CC404649A44610CBF8B2056CF2
SHA-512:	62990CB16E37B6B4EFF6AB03571C3A82DCAA21A1D393C3CB01D81F62287777FB0B4B27F8852B5FA71BC975FEAB5BAA486D33F2C58660210E115DE7E2BD34EA63
Malicious:	false
Preview:	BM~g......v...(.......:............g..................................................................................DDD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@..DDD....DDDDDD........................................DDDDDDDDDD....DDDDDDDDD........DD@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDD@@@@DDDDDDDDDD@@@@@@D..DD....DDDDDDD......................................DDDDDDDDDD....DDDDDDDDDD......D..D@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@DDD..D.....DDDDDD......................................DDDDDDDDD.....DDDDDDDDD......DDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDDD@@@@@@DDDD.......DDDDDD.....................................DDDDDDDDDD....DDDDDDDDDD.....DDDDD..@@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@DDDDDDDDDD@@@@DDDDDDDDD@@@@@@DDDDDD.......DDDDDD....................................DDDDDDDDD....DDDDDDDDDD......DDDDDD..@@@@DDDDDD@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsArray.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.329913522821918
Encrypted:	false
SSDEEP:	384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
MD5:	9761D708EA7C49662A21F6690D439E06
SHA1:	B2E757E7EEE5C788F16D666FB6CF9D41CACCB04B
SHA-256:	8B8BE21FA7BCA491C93683C9F84BB49370CA7E1E864BD0658FF9E1D2809B67E4
SHA-512:	25990A993373009CCBD9E89CAE3FC601928121775D0D5FE326C55A305CE8DE51F35A2CB160E9DFBF3BE82A53DDF7B9864116E7F5D3325AFD7403CD3B7740C652
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%)y.aH..aH..aH..h0..dH..aH..jH..h0..`H..z..cH..z..`H..z..`H..z..`H..RichaH..........................PE..L.....iO...........!.............p..0................................................\....@.........................$.......X...........X...............8/.........................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsExec.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.099446360233213
Encrypted:	false
SSDEEP:	384:BqbGgezxEqoyGgmkN7ZSf+VIYiWLSL/Pxh8E9VF0Ny4LN2:431yGLk8/YiWePxWEOZ2
MD5:	9EA6EC7934495CC757639B5095362CA7
SHA1:	EF2C14142B70689483576CC09083DB4A2A363E02
SHA-256:	4D8C8353641BBB26BF9EA2AB2DBF126BE6EF164B1CE80E3EF5030B873BE166CD
SHA-512:	414B08F75BD7FEBB56784D8534CEE028F6420776F07CE5797F66A78748C34B52F443AA35F72C8D7C81DD5366B34998B56D99A9D0D2B4B2B6BFC9775E4FF66531
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....z.W...........!......................... ...............................P.......................................$..l.... ..P.......................8/...@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\nsis7z.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	191800
Entropy (8bit):	6.526825420894023
Encrypted:	false
SSDEEP:	3072:OBFxfbJUIW9WGExPYD5JFBJOYWjm8KCmRv1fPIVF2tbRpj/uxe:qxzJSAGEdYD5JcYl78FsLP
MD5:	7FE20CEE9277556F4EF137E61D29D9F5
SHA1:	D53C37DBF548914ED20C8EBB21186A95BEEF1EE3
SHA-256:	5D71AAEEFBC81732017E9040C8087E6686A16DD54E6D9BCD5BA7A47AF68CC925
SHA-512:	A90250214C6C5048B098E031FCA5A8097854A8667330551D7694740E3BC83F7D77791D314E3AC75617EF1834B75C41E3E3D3C74DA9794A207894C13FB2D4BEF7
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......T.I............7y......7y..9...7y..c...........................i.....7y..~...7y......7y......7y......Rich............................PE..L......M...........!.................w....................................... .......o.............................. {.......q..P.......H...............8/......0...................................8;..@............................................text............................... ..`.rdata...k.......l..................@..@.data...._...........p..............@....rsrc...H...........................@..@.reloc...........0..................@..B................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\start_unicode.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	2132
Entropy (8bit):	3.6766180432153184
Encrypted:	false
SSDEEP:	48:ArTYGhjKCTwsrf4VdwX+xwI0eqKb1Cj7X:+T5KCHrgVo+RBb1CHX
MD5:	052E8A84B4802AB02BC09EF283294885
SHA1:	350C1B18A08DB640808924D530E8462D297A1F7B
SHA-256:	45A0F0E1B54CF2ABDC883245C3A9ABCC7B3F879E12EDB946B5B4A6A426118E4E
SHA-512:	46E01F0B5164149CB281C1C54F0705256FE3F891CBCCD375FF78F47093E869BA5465AF1AFFD1D9D1520B0E13A73375929EF8E716116C744A1E197333DA16F36B
Malicious:	false
Preview:	..;. .A.u.t.o.-.g.e.n.e.r.a.t.e.d. .b.y. .E.c.l.i.p.s.e.N.S.I.S. .I.n.s.t.a.l.l.O.p.t.i.o.n.s. .S.c.r.i.p.t. .W.i.z.a.r.d.....;. .3.0...0.1...2.0.0.6. .1.1.:.1.9.:.5.5.....[.S.e.t.t.i.n.g.s.].....N.u.m.F.i.e.l.d.s.=.9.....R.T.L.=.0.....S.t.a.t.e.=.0.........[.F.i.e.l.d. .8.].....T.y.p.e.=.L.a.b.e.l.....L.e.f.t.=.1.0.....T.o.p.=.1.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.1.0.....T.e.x.t.=.H.o.w. .d.o. .y.o.u. .w.a.n.t. .t.o. .p.r.o.c.e.e.d.?.....H.W.N.D.=.6.6.6.9.4.........[.F.i.e.l.d. .1.].....T.y.p.e.=.R.a.d.i.o.B.u.t.t.o.n.....L.e.f.t.=.1.5.....T.o.p.=.1.3.....R.i.g.h.t.=.2.9.7.....B.o.t.t.o.m.=.2.9.....T.e.x.t.=.D.e.f.a.u.l.t. .i.n.s.t.a.l.l.a.t.i.o.n.....S.t.a.t.e.=.1.....F.l.a.g.s.=.G.R.O.U.P.\|.N.O.T.I.F.Y.....H.W.N.D.=.6.6.6.8.4.........[.F.i.e.l.d. .7.].....T.y.p.e.=.C.h.e.c.k.B.o.x.....L.e.f.t.=.1.0.....T.o.p.=.1.5.2.....R.i.g.h.t.=.2.1.5.....B.o.t.t.o.m.=.1.6.3.....T.e.x.t.=.S.h.o.w. .a.d.v.a.n.c.e.d. .s.e.t.t.i.n.g.s.....S.t.a.t.e.=.0.....F.l.a.g.s.=.N.O.T.I.F.Y.....H.W.N.D.=.

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\TvGetVersion.dll

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	702776
Entropy (8bit):	6.74302767407908
Encrypted:	false
SSDEEP:	12288:H9bt5E1nHSqUSCX0UD0GgUGLt9jkqvaStOIkWk5Yu5yclFQxq8p0:H9btgnHSqUSCXnD0GgUGLt9jkm3Ask5v
MD5:	878C644C12C3D96438C2909FBB7375CD
SHA1:	4FB206E213BD088E28A1C10AB815D1BFD1B522F1
SHA-256:	75CF60D72A2CB6A748DB6F69E2BFA065422DF7BB6636D3C214F5435341574A66
SHA-512:	DF0D1903901FFAF7CA1EE22CC5B8BAC37CB554F78ED07A8CCAF84A2CD6FB7F9AC5599CAAD83D92079E170190701A9391468331EC8AA562BFDF32376703E05BD8
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......L..(.p.{.p.{.p.{...z.p.{...z.p.{...z.p.{...z.p.{.p.{.p.{Z..zNp.{Z..z.p.{Z..z.p.{\S.{.p.{...z.p.{...z.p.{...{.p.{.pq{.p.{...z.p.{Rich.p.{........PE..L......d...........!................................................................C.....@.........................P... ...p ..........@...............8/.......Q..\|...T.............................@...............$............................text............................... ..`.rdata.............................@..@.data....@...@......................@....rsrc...@............2..............@..@.reloc...Q.......R...8..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TV15Install.log

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	3354
Entropy (8bit):	5.062891018314198
Encrypted:	false
SSDEEP:	48:wRLjoR9Cl3nB5mKyDhEHjU6oKZwM2an0267i7f184h64X7LZfLIDb2x0w:0Lj+8aJED7ZwM2apyC6OLR3
MD5:	97AF2ED88273A53CCFD562151E13DE79
SHA1:	15D14629F85C10F002600C8DE693DA4FD8274A28
SHA-256:	B869251559F5192C889FA6BF5896B4C22F255F219DF66A51D0BF7A42622B2407
SHA-512:	C61FA6F263E7793F82F71D8E8FB01FE100A295D9A51CB7D1F8012D45411C7294DFF1DAEF8AF8EFF51CA41FC24777439CCB52F362F174F96DB4A7332A74DE2CBF
Malicious:	false
Preview:	2024-12-09-12-42-44 ----------------------------------------------------------------------------------------------------..2024-12-09-12-42-44 Installer: TeamViewer..2024-12-09-12-42-44 Version: 15.59.5 (JMP-91.4)..2024-12-09-12-42-44 Install mode: Admin..2024-12-09-12-42-44 Account type: Admin, UAC supported:1, Elevation:2..2024-12-09-12-42-44 Time: 2024-12-09-12-42-44..2024-12-09-12-42-44 OS-Version: 10.0.19045(64-bit) SP:0, Type:1..2024-12-09-12-42-44 OS-Info: Server:0 Home server:0..2024-12-09-12-42-44 User-SID: S-1-5-21-2246122658-3693405117-2476756634-1002..2024-12-09-12-42-44 Log level: 100 (default)..2024-12-09-12-42-44 ----------------------------------------------------------------------------------------------------..2024-12-09-12-42-44 ..2024-12-09-12-42-46 TVInitRollback(): create scheduled task for restore..2024-12-09-12-42-46 Create backup directory:<C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TVInstallTemp>..

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, Nullsoft Installer self-extracting archive
Category:	dropped
Size (bytes):	71272344
Entropy (8bit):	7.999987306679704
Encrypted:	true
SSDEEP:	1572864:re9Md8ir5RcKqhxdJjHKO56/nMgt5LhZx5oZiJG2Ol40hi7id:C2NdRTqhXJDLenHhZx+ZiJcl4m
MD5:	8318FC63158C01368AADC6D4BE89FAD1
SHA1:	88F4AEFCBDD5A748EC21469A565D9C57B7F6CB46
SHA-256:	B64A8F72105117FF71ECA4692DF030B6E60C4ABA2631E0FE01411086BB42B1DC
SHA-512:	DB7601C5A1AD25CF3F076C8C504EB885D3EBE6358A6490492DEE967C7FF5AC72319AAF75EDBFFD7FB0F7102473A2C16830408C7762283C67A374535EF8420076
Malicious:	true
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$........1..P...P...P.._...P...P..OP.._...P..s...P...V...P..Rich.P..........PE..L....z.W.................b...*.......3............@.................................0k@...@..........................................`..............hX?.0/...........................................................................................text...]a.......b.................. ..`.rdata...............f..............@..@.data...8............z..............@....ndata...................................rsrc........`......................@..@................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\install.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	78
Entropy (8bit):	4.299916880895009
Encrypted:	false
SSDEEP:	3:HWRBXUrDikRLWvSGXR1mQWRKRL4RLJ:H8XUWkRL+TWgL4RLJ
MD5:	A3C26DD25FC88922E9297E2A9D04AC53
SHA1:	807B0CA16C4080B6CE7AE8B09E7DCCE7E52D5C19
SHA-256:	1C5231379C3025A42D51F956F649C445EBC550F9AD9B9F5CC4AE5E627EF456B3
SHA-512:	1D36EE7B43D82B72000520C0B0C37585576363FCD506AEAB362C544000B0BF9702A357E118B2AE3499D8F8C9A7529F56169CC14E5281A5246AE9EFD342C4FA59
Malicious:	false
Preview:	[Installer]..DefaultInstallation=1..UnattendedAccess=0..CustomInstallation=0..

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\tvinfo.ini

Download File

Process:	C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	50
Entropy (8bit):	4.703465189601647
Encrypted:	false
SSDEEP:	3:HWRFRLMKxKAhdXCzTtA7:H4RLMqKAh8zm
MD5:	A48B05E8E36F7F4E9096ADE8950B87E4
SHA1:	C743C68FB5798389435927338D1C8ED1C59496A2
SHA-256:	72935BCB05A31B405A0E4A13EB0BABD1640BBE03FAD52FF85FFA91390D0E8EEE
SHA-512:	7943A5C44C136347F199A1A3E1AA8AF3F4EE9D5024D4588E3FAA95F57DCD51292E606A057D567D45C8BC9D62EBFCFEBD199654D1F1214B205124418C592F47F7
Malicious:	false
Preview:	[Installation]..INSTEXE=TeamViewer_Setup_x64.exe..

C:\Windows\Temp\nsfB965.tmp\System.dll

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	23864
Entropy (8bit):	6.996623524463238
Encrypted:	false
SSDEEP:	384:58QIl975eXqlWBrz7YLOlACZSf+VIYiWLbLWQaZdPxh8E9VF0Ny0W3N9:5gPgrfYLOWJ/YiW8PxWE6Y9
MD5:	938C37B523D7FC08166E7A5810DD0F8E
SHA1:	47B9663E5873669211655E0010E322F71B5A94BE
SHA-256:	A91AA7C0EAD677FC01B1C864E43E0CACE110AFB072B76AD47F4B3D1563F4DC20
SHA-512:	77AFE83FB4E80A775DAE0A54A2F0FF9710C135F9F1CF77396BC08A7FE46B016A8C079B4FA612E764EEA5D258703F860688E38B443E33B1F980E04831739517C1
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......1...u.u.u...s.u.a....r.!..q....t....t.Richu.........................PE..L....z.W...........!..... ...........'.......0...............................`......\|#...............................2.......0..P.......................8/...P.......................................................0..X............................text............ .................. ..`.rdata..S....0.......$..............@..@.data...x....@.......(..............@....reloc..b....P.......*..............@..B................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\nsfB965.tmp\nsArray.dll

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.329913522821918
Encrypted:	false
SSDEEP:	384:nqqedh6EHFRksp7KpFX1ZSf+VIYiWLALiqPxh8E9VF0NymgEy:Ted/FR9mXc/YiWMPxWEspy
MD5:	9761D708EA7C49662A21F6690D439E06
SHA1:	B2E757E7EEE5C788F16D666FB6CF9D41CACCB04B
SHA-256:	8B8BE21FA7BCA491C93683C9F84BB49370CA7E1E864BD0658FF9E1D2809B67E4
SHA-512:	25990A993373009CCBD9E89CAE3FC601928121775D0D5FE326C55A305CE8DE51F35A2CB160E9DFBF3BE82A53DDF7B9864116E7F5D3325AFD7403CD3B7740C652
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......%)y.aH..aH..aH..h0..dH..aH..jH..h0..`H..z..cH..z..`H..z..`H..z..`H..RichaH..........................PE..L.....iO...........!.............p..0................................................\....@.........................$.......X...........X...............8/.........................................................................................UPX0.....p..............................UPX1................................@....rsrc...............................@......................................................................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Windows\Temp\nsfB965.tmp\nsExec.dll

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	18744
Entropy (8bit):	7.099446360233213
Encrypted:	false
SSDEEP:	384:BqbGgezxEqoyGgmkN7ZSf+VIYiWLSL/Pxh8E9VF0Ny4LN2:431yGLk8/YiWePxWEOZ2
MD5:	9EA6EC7934495CC757639B5095362CA7
SHA1:	EF2C14142B70689483576CC09083DB4A2A363E02
SHA-256:	4D8C8353641BBB26BF9EA2AB2DBF126BE6EF164B1CE80E3EF5030B873BE166CD
SHA-512:	414B08F75BD7FEBB56784D8534CEE028F6420776F07CE5797F66A78748C34B52F443AA35F72C8D7C81DD5366B34998B56D99A9D0D2B4B2B6BFC9775E4FF66531
Malicious:	false
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.........................,..................Rich...........PE..L....z.W...........!......................... ...............................P.......................................$..l.... ..P.......................8/...@....................................................... ...............................text............................... ..`.rdata..L.... ......................@..@.data........0......................@....reloc.......@......................@..B................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\nstB6B4.tmp

Download File

Process:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
File Type:	data
Category:	dropped
Size (bytes):	4373449
Entropy (8bit):	4.833524282835361
Encrypted:	false
SSDEEP:	24576:iJEhVu0vN6aSoGsZwXV22NNNKwhfmH5abENDzfL00+3JGqlxCsKEjzSKJ:rNvSoGsZwXV2ExnbEND00QssKEjOKJ
MD5:	EDF7280BB63AB1B61C0570FE45F88C03
SHA1:	0A62C191B86D43167FF9DFBBA1B07BF43E78F9AA
SHA-256:	9C0A7FCF2D343D53A05FB2A8D3487BEC96A32CE0A1FD16AC887AEFE4D26F1640
SHA-512:	E3606BAA52879EF78DED7BE0CA1D10168C2F6C3A201B404AF332EE72DF0EB66830D047C538E72E972D12ACE8FD72E298FF9F8AFF89A0A6053501B170CD44F435
Malicious:	false
Preview:	.b%.....,.......................<.......r1%.!....b%.....................................................~...................................................................................................................................................................................G...J.......................F.......y.......................................................................................................................%...............................................................................................................................D.......k..............................................j.......l...r...t..............................................................................................................................4.......................................................................................................................................................................................................................................

C:\Windows\assembly\Desktop.ini

Download File

Process:	C:\Users\user\Desktop\lz3EbiqoK4.exe
File Type:	Windows desktop.ini
Category:	dropped
Size (bytes):	227
Entropy (8bit):	5.2735028737400205
Encrypted:	false
SSDEEP:	6:a1eZBXVNYTF0NwoScUbtSgyAXIWv7v5PMKq:UeZBFNYTswUq1r5zq
MD5:	F7F759A5CD40BC52172E83486B6DE404
SHA1:	D74930F354A56CFD03DC91AA96D8AE9657B1EE54
SHA-256:	A709C2551B8818D7849D31A65446DC2F8C4CCA2DCBBC5385604286F49CFDAF1C
SHA-512:	A50B7826BFE72506019E4B1148A214C71C6F4743C09E809EF15CD0E0223F3078B683D203200910B07B5E1E34B94F0FE516AC53527311E2943654BFCEADE53298
Malicious:	false
Preview:	; ==++==..; ..; Copyright (c) Microsoft Corporation. All rights reserved...; ..; ==--==..[.ShellClassInfo]..CLSID={1D2680C9-0E2A-469d-B787-065558BC7D43}..ConfirmFileOp=1..InfoTip=Contains application stability information...

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.999972392721924
TrID:	Win32 Executable (generic) a (10002005/4) 99.96% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% Autodesk FLIC Image File (extensions: flc, fli, cel) (7/3) 0.00%
File name:	lz3EbiqoK4.exe
File size:	75'655'168 bytes
MD5:	33c2adebfe2c3acedfb34ffff8151b7d
SHA1:	8e93f7ecafa92017a7d528423574ab5cfeec754a
SHA256:	773e13fffd0842e717ce55e2a678da37123c55186f9c92460c671261b1654ffd
SHA512:	6f545b4da55412ec78de6d1c3bddbcc6bb857b7d13b15fe4bb832259dbe1842d44a02b46395233c23ca57abd34239226a60c9f7ee26fcf82ba383a836f8d61ad
SSDEEP:	1572864:yIWs/6+mI5n17YTIytz8ATFiQiFGaaoE13gIFxXtzM/zMfCOA6Z:ssJmIBiTvR8UFiQYGvoq35FVEeCOr
TLSH:	FAF73320BC930947E55128B9B4E1FE3F080DAF376F74A47B1D753E07BE38666A09644A
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$..........k...8...8...8...8...8.m.8...8...8...8...8...8...8#..8...8...8Rich...8........PE..L.....Sg..........#........................

File Icon


Icon Hash:	71e0d49292c0f033

Static PE Info

General

Entrypoint:	0x40ccef
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, LARGE_ADDRESS_AWARE, 32BIT_MACHINE
DLL Characteristics:	TERMINAL_SERVER_AWARE
Time Stamp:	0x675394E3 [Sat Dec 7 00:20:51 2024 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	9dd8c0ff4fc84287e5b766563240f983

Entrypoint Preview

Instruction
call 00007FBDF0827146h
jmp 00007FBDF0821309h
mov edi, edi
push ebp
mov ebp, esp
sub esp, 20h
mov eax, dword ptr [ebp+08h]
push esi
push edi
push 00000008h
pop ecx
mov esi, 0041F058h
lea edi, dword ptr [ebp-20h]
rep movsd
mov dword ptr [ebp-08h], eax
mov eax, dword ptr [ebp+0Ch]
pop edi
mov dword ptr [ebp-04h], eax
pop esi
test eax, eax
je 00007FBDF082146Eh
test byte ptr [eax], 00000008h
je 00007FBDF0821469h
mov dword ptr [ebp-0Ch], 01994000h
lea eax, dword ptr [ebp-0Ch]
push eax
push dword ptr [ebp-10h]
push dword ptr [ebp-1Ch]
push dword ptr [ebp-20h]
call dword ptr [0041B000h]
leave
retn 0008h
ret
mov eax, 00413523h
mov dword ptr [004228E4h], eax
mov dword ptr [004228E8h], 00412C0Ah
mov dword ptr [004228ECh], 00412BBEh
mov dword ptr [004228F0h], 00412BF7h
mov dword ptr [004228F4h], 00412B60h
mov dword ptr [004228F8h], eax
mov dword ptr [004228FCh], 0041349Bh
mov dword ptr [00422900h], 00412B7Ch
mov dword ptr [00422904h], 00412ADEh
mov dword ptr [00422908h], 00412A6Bh
ret
mov edi, edi
push ebp
mov ebp, esp
call 00007FBDF08213FBh
call 00007FBDF0827C80h
cmp dword ptr [ebp+00h], 00000000h

Rich Headers

Programming Language:

[ASM] VS2008 build 21022
[IMP] VS2005 build 50727
[C++] VS2008 build 21022
[ C ] VS2008 build 21022
[LNK] VS2008 build 21022

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0x215b4	0x64	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x26000	0x4804714	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x1b1d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x20da0	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x1b000	0x18c	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x196d8	0x19800	bbd3e5395b15b06d2967530b6b59018e	False	0.5780292585784313	data	6.745940569149453	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x1b000	0x6df2	0x6e00	2a36cd4e315443b43c4620372d9a9076	False	0.5467329545454546	data	6.443128575748918	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0x22000	0x30c0	0x1600	b37653ac83a62b9683f8689b82ddcb74	False	0.3126775568181818	data	3.2624449625054814	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x26000	0x4804714	0x4804800	49cc2cd8fc6ad777f21fa40d77936351	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	ZLIB Complexity
RT_ICON	0x261fc	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	0.17641843971631205
RT_ICON	0x26664	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	0.10834896810506567
RT_ICON	0x2770c	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	0.08651452282157676
RT_ICON	0x29cb4	0x25ee	PNG image data, 256 x 256, 8-bit/color RGBA, non-interlaced	0.9794026776519053
RT_RCDATA	0x2c2a4	0x47fe11b	data	1.0003108978271484
RT_RCDATA	0x482a3c0	0x20	data	1.28125
RT_GROUP_ICON	0x482a3e0	0x3e	data	0.7903225806451613
RT_VERSION	0x482a420	0x2f4	data	0.4470899470899471

Imports

DLL	Import
KERNEL32.dll	RaiseException, GetLastError, MultiByteToWideChar, lstrlenA, InterlockedDecrement, GetProcAddress, LoadLibraryA, FreeResource, SizeofResource, LockResource, LoadResource, FindResourceA, GetModuleHandleA, Module32Next, CloseHandle, Module32First, CreateToolhelp32Snapshot, GetCurrentProcessId, SetEndOfFile, GetStringTypeW, GetStringTypeA, LCMapStringW, LCMapStringA, GetLocaleInfoA, CreateFileA, HeapFree, GetProcessHeap, HeapAlloc, GetCommandLineA, HeapCreate, VirtualFree, DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, VirtualAlloc, HeapReAlloc, HeapSize, TerminateProcess, GetCurrentProcess, UnhandledExceptionFilter, SetUnhandledExceptionFilter, IsDebuggerPresent, GetModuleHandleW, Sleep, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, WideCharToMultiByte, GetConsoleCP, GetConsoleMode, ReadFile, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, InterlockedIncrement, SetLastError, GetCurrentThreadId, FlushFileBuffers, SetFilePointer, SetHandleCount, GetFileType, GetStartupInfoA, RtlUnwind, FreeEnvironmentStringsA, GetEnvironmentStrings, FreeEnvironmentStringsW, GetEnvironmentStringsW, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, InitializeCriticalSectionAndSpinCount, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, CompareStringA, CompareStringW, SetEnvironmentVariableA, WriteConsoleA, GetConsoleOutputCP, WriteConsoleW, SetStdHandle
ole32.dll	OleInitialize
OLEAUT32.dll	VariantInit, SafeArrayCreate, SafeArrayAccessData, SafeArrayUnaccessData, SafeArrayDestroy, SafeArrayCreateVector, VariantClear, SysFreeString, SysAllocString
mscoree.dll	CorBindToRuntimeEx

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 9, 2024 18:42:32.485327005 CET	49732	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:32.604911089 CET	22269	49732	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:32.605057001 CET	49732	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:32.623909950 CET	49732	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:32.746009111 CET	22269	49732	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:33.683578014 CET	22269	49732	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:33.683639050 CET	49732	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:33.812875986 CET	49732	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:33.933449984 CET	22269	49732	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:37.505851030 CET	49736	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:37.625386000 CET	22269	49736	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:37.625463963 CET	49736	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:37.626025915 CET	49736	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:37.746325016 CET	22269	49736	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:38.691016912 CET	22269	49736	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:38.691169977 CET	49736	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:38.691440105 CET	49736	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:38.811546087 CET	22269	49736	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:42.181277037 CET	49738	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:42.300753117 CET	22269	49738	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:42.304675102 CET	49738	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:42.306848049 CET	49738	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:42.426448107 CET	22269	49738	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:43.377599955 CET	22269	49738	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:43.377665043 CET	49738	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:43.378091097 CET	49738	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:43.497682095 CET	22269	49738	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:46.959695101 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:47.171173096 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:47.172661066 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:47.172972918 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:47.292470932 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:48.240943909 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:48.241012096 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:48.243558884 CET	49739	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:48.363023043 CET	22269	49739	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:51.772017956 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:51.892571926 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:51.892709017 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:51.893012047 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:52.012271881 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:52.970838070 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:52.970933914 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:52.971249104 CET	49740	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:53.091331005 CET	22269	49740	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:56.350411892 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:56.471961021 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:56.472101927 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:56.473413944 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:56.593369961 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:57.555212975 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:42:57.555295944 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:57.555592060 CET	49741	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:42:57.674967051 CET	22269	49741	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:00.962615013 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:01.082153082 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:01.082273006 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:01.082691908 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:01.203124046 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:02.150861025 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:02.150918961 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:02.151331902 CET	49742	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:02.270890951 CET	22269	49742	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:05.836566925 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:05.957878113 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:05.958766937 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:05.959131956 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:06.078675985 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:07.026519060 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:07.026612997 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:07.027283907 CET	49744	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:07.147327900 CET	22269	49744	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:10.435519934 CET	49752	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:10.554932117 CET	22269	49752	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:10.555126905 CET	49752	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:10.555471897 CET	49752	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:10.675374985 CET	22269	49752	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:11.627592087 CET	22269	49752	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:11.628774881 CET	49752	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:11.629467010 CET	49752	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:11.749890089 CET	22269	49752	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:14.915030956 CET	49762	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:15.034482002 CET	22269	49762	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:15.034827948 CET	49762	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:15.035171032 CET	49762	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:15.154614925 CET	22269	49762	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:16.103602886 CET	22269	49762	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:16.103666067 CET	49762	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:16.103951931 CET	49762	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:16.225706100 CET	22269	49762	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:19.474622011 CET	49773	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:19.594733953 CET	22269	49773	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:19.594844103 CET	49773	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:19.595268965 CET	49773	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:19.714987993 CET	22269	49773	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:20.668302059 CET	22269	49773	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:20.668389082 CET	49773	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:20.668715954 CET	49773	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:20.787955999 CET	22269	49773	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:24.084032059 CET	49788	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:24.203830004 CET	22269	49788	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:24.204006910 CET	49788	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:24.204257011 CET	49788	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:24.323529959 CET	22269	49788	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:25.279822111 CET	22269	49788	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:25.279987097 CET	49788	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:25.280244112 CET	49788	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:25.399570942 CET	22269	49788	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:28.288996935 CET	49798	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:28.408344984 CET	22269	49798	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:28.408516884 CET	49798	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:28.408970118 CET	49798	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:28.530900002 CET	22269	49798	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:29.482505083 CET	22269	49798	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:29.482661009 CET	49798	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:29.483087063 CET	49798	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:29.602385998 CET	22269	49798	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:32.162080050 CET	49806	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:32.282885075 CET	22269	49806	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:32.283004045 CET	49806	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:32.283441067 CET	49806	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:32.403143883 CET	22269	49806	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:33.354510069 CET	22269	49806	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:33.354597092 CET	49806	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:33.355026960 CET	49806	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:33.474263906 CET	22269	49806	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:35.725500107 CET	49816	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:35.849548101 CET	22269	49816	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:35.849767923 CET	49816	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:35.850085020 CET	49816	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:35.969592094 CET	22269	49816	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:36.918215036 CET	22269	49816	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:36.918346882 CET	49816	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:36.918675900 CET	49816	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:37.038106918 CET	22269	49816	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:38.959171057 CET	49822	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:39.078701019 CET	22269	49822	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:39.078990936 CET	49822	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:39.079366922 CET	49822	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:39.198699951 CET	22269	49822	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:40.146323919 CET	22269	49822	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:40.146395922 CET	49822	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:40.150089979 CET	49822	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:40.272470951 CET	22269	49822	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:42.037113905 CET	49833	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:42.156492949 CET	22269	49833	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:42.156714916 CET	49833	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:42.157097101 CET	49833	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:42.276381969 CET	22269	49833	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:43.224586964 CET	22269	49833	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:43.224651098 CET	49833	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:43.224999905 CET	49833	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:43.344275951 CET	22269	49833	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:44.912130117 CET	49839	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:45.031533003 CET	22269	49839	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:45.031663895 CET	49839	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:45.031997919 CET	49839	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:45.151407003 CET	22269	49839	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:46.124846935 CET	22269	49839	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:46.124970913 CET	49839	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:46.125444889 CET	49839	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:46.246567011 CET	22269	49839	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:47.584352016 CET	49845	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:47.704113007 CET	22269	49845	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:47.704190969 CET	49845	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:47.704579115 CET	49845	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:47.824310064 CET	22269	49845	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:48.775769949 CET	22269	49845	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:48.776048899 CET	49845	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:48.776235104 CET	49845	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:48.896904945 CET	22269	49845	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:49.991238117 CET	49851	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:50.111812115 CET	22269	49851	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:50.111953974 CET	49851	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:50.112421989 CET	49851	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:50.237306118 CET	22269	49851	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:51.216090918 CET	22269	49851	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:51.216687918 CET	49851	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:51.216993093 CET	49851	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:51.336258888 CET	22269	49851	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:52.352514029 CET	49857	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:52.471865892 CET	22269	49857	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:52.471950054 CET	49857	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:52.474265099 CET	49857	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:52.593487024 CET	22269	49857	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:53.539511919 CET	22269	49857	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:53.539625883 CET	49857	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:53.539932013 CET	49857	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:53.660399914 CET	22269	49857	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:54.459192991 CET	49863	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:54.578706026 CET	22269	49863	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:54.578805923 CET	49863	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:54.579121113 CET	49863	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:54.698374033 CET	22269	49863	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:55.662058115 CET	22269	49863	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:55.662147045 CET	49863	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:55.662439108 CET	49863	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:55.781677961 CET	22269	49863	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:56.568361998 CET	49869	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:56.740592003 CET	22269	49869	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:56.740669012 CET	49869	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:56.740964890 CET	49869	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:56.918709040 CET	22269	49869	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:57.835248947 CET	22269	49869	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:57.835306883 CET	49869	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:57.835594893 CET	49869	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:57.954876900 CET	22269	49869	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:58.583941936 CET	49875	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:58.704365969 CET	22269	49875	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:58.704483032 CET	49875	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:58.704838037 CET	49875	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:58.824172020 CET	22269	49875	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:59.776535034 CET	22269	49875	167.71.56.116	192.168.2.4
Dec 9, 2024 18:43:59.776663065 CET	49875	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:59.776953936 CET	49875	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:43:59.896326065 CET	22269	49875	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:00.459075928 CET	49881	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:00.578847885 CET	22269	49881	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:00.578963995 CET	49881	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:00.579327106 CET	49881	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:00.698851109 CET	22269	49881	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:01.713010073 CET	22269	49881	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:01.713116884 CET	49881	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:01.713526011 CET	49881	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:01.832818985 CET	22269	49881	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:02.334250927 CET	49887	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:02.453602076 CET	22269	49887	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:02.453696966 CET	49887	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:02.454034090 CET	49887	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:02.573790073 CET	22269	49887	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:03.546403885 CET	22269	49887	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:03.546461105 CET	49887	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:03.548193932 CET	49887	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:03.667699099 CET	22269	49887	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:04.037175894 CET	49893	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:04.156616926 CET	22269	49893	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:04.156745911 CET	49893	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:04.157078981 CET	49893	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:04.276483059 CET	22269	49893	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:05.235028982 CET	22269	49893	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:05.235088110 CET	49893	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:05.235342026 CET	49893	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:05.354665041 CET	22269	49893	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:05.709280014 CET	49899	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:05.828644037 CET	22269	49899	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:05.828741074 CET	49899	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:05.829108000 CET	49899	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:05.950320959 CET	22269	49899	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:06.903887987 CET	22269	49899	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:06.903964043 CET	49899	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:06.904266119 CET	49899	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:07.023968935 CET	22269	49899	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:07.318440914 CET	49900	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:07.439547062 CET	22269	49900	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:07.439682961 CET	49900	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:07.440042019 CET	49900	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:07.559372902 CET	22269	49900	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:08.518408060 CET	22269	49900	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:08.518532038 CET	49900	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:08.518906116 CET	49900	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:08.638777971 CET	22269	49900	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:08.865309954 CET	49906	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:08.984714031 CET	22269	49906	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:08.988718987 CET	49906	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:08.989032030 CET	49906	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:09.109174013 CET	22269	49906	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:10.089153051 CET	22269	49906	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:10.089330912 CET	49906	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:10.089616060 CET	49906	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:10.209232092 CET	22269	49906	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:10.396632910 CET	49912	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:10.516422987 CET	22269	49912	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:10.516503096 CET	49912	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:10.516822100 CET	49912	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:10.636302948 CET	22269	49912	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:11.629138947 CET	22269	49912	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:11.629200935 CET	49912	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:11.629499912 CET	49912	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:11.748847961 CET	22269	49912	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:11.927722931 CET	49913	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:12.047779083 CET	22269	49913	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:12.048024893 CET	49913	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:12.048233986 CET	49913	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:12.168364048 CET	22269	49913	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:13.165586948 CET	22269	49913	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:13.165676117 CET	49913	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:13.165978909 CET	49913	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:13.285258055 CET	22269	49913	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:13.412832975 CET	49919	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:13.533902884 CET	22269	49919	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:13.534117937 CET	49919	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:13.534584999 CET	49919	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:13.656333923 CET	22269	49919	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:14.678545952 CET	22269	49919	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:14.678746939 CET	49919	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:14.679079056 CET	49919	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:14.798687935 CET	22269	49919	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:14.927725077 CET	49925	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:15.047811985 CET	22269	49925	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:15.047895908 CET	49925	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:15.048197031 CET	49925	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:15.167651892 CET	22269	49925	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:16.122123003 CET	22269	49925	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:16.122194052 CET	49925	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:16.122508049 CET	49925	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:16.241817951 CET	22269	49925	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:16.318624973 CET	49926	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:16.438133001 CET	22269	49926	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:16.438234091 CET	49926	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:16.438596964 CET	49926	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:16.558648109 CET	22269	49926	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:17.506483078 CET	22269	49926	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:17.506597996 CET	49926	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:17.507142067 CET	49926	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:17.629072905 CET	22269	49926	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:17.693559885 CET	49932	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:17.813818932 CET	22269	49932	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:17.813925982 CET	49932	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:17.814265966 CET	49932	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:17.935659885 CET	22269	49932	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:18.945888996 CET	22269	49932	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:18.945990086 CET	49932	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:18.946274042 CET	49932	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:19.065587997 CET	22269	49932	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:19.115359068 CET	49935	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:19.234740019 CET	22269	49935	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:19.234870911 CET	49935	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:19.235215902 CET	49935	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:19.354500055 CET	22269	49935	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:20.304228067 CET	22269	49935	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:20.304433107 CET	49935	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:20.304749012 CET	49935	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:20.444735050 CET	49939	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:20.480912924 CET	22269	49935	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:20.730696917 CET	22269	49939	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:20.730786085 CET	49939	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:20.731112957 CET	49939	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:20.850580931 CET	22269	49939	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:21.841228962 CET	22269	49939	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:21.841298103 CET	49939	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:21.841656923 CET	49939	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:21.960908890 CET	22269	49939	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:21.974729061 CET	49945	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:22.094182014 CET	22269	49945	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:22.094321012 CET	49945	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:22.094768047 CET	49945	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:22.214967012 CET	22269	49945	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:23.162849903 CET	22269	49945	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:23.162919044 CET	49945	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:23.163206100 CET	49945	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:23.271435976 CET	49946	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:23.285407066 CET	22269	49945	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:23.390917063 CET	22269	49946	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:23.391019106 CET	49946	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:23.391334057 CET	49946	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:23.510961056 CET	22269	49946	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:24.460199118 CET	22269	49946	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:24.460356951 CET	49946	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:24.460606098 CET	49946	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:24.568380117 CET	49952	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:24.579865932 CET	22269	49946	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:24.688162088 CET	22269	49952	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:24.688252926 CET	49952	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:24.688564062 CET	49952	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:24.808341026 CET	22269	49952	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:25.757468939 CET	22269	49952	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:25.760771990 CET	49952	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:25.761025906 CET	49952	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:25.849548101 CET	49958	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:25.884784937 CET	22269	49952	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:25.969115019 CET	22269	49958	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:25.970966101 CET	49958	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:25.971410036 CET	49958	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:26.091240883 CET	22269	49958	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:27.067043066 CET	22269	49958	167.71.56.116	192.168.2.4
Dec 9, 2024 18:44:27.067224026 CET	49958	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:31.674843073 CET	49958	22269	192.168.2.4	167.71.56.116
Dec 9, 2024 18:44:31.794128895 CET	22269	49958	167.71.56.116	192.168.2.4

Target ID:	0
Start time:	12:42:12
Start date:	09/12/2024
Path:	C:\Users\user\Desktop\lz3EbiqoK4.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\lz3EbiqoK4.exe"
Imagebase:	0x400000
File size:	75'655'168 bytes
MD5 hash:	33C2ADEBFE2C3ACEDFB34FFFF8151B7D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	12:42:27
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\Client-built.exe
Wow64 process (32bit):	false
Commandline:	"C:\Users\user\AppData\Local\Temp\Client-built.exe"
Imagebase:	0x100000
File size:	3'266'048 bytes
MD5 hash:	181719B653C83D0463D89A625A7F5C3E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000000.1927009729.0000000000420000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.3103987388.0000000002841000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000000.1914043625.0000000000102000.00000002.00000001.01000000.00000007.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: 00000001.00000002.3103987388.00000000029C5000.00000004.00000800.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_Quasar, Description: Yara detected Quasar RAT, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Joe Security Rule: JoeSecurity_GenericDownloader_1, Description: Yara detected Generic Downloader, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Joe Security Rule: MAL_QuasarRAT_May19_1, Description: Detects QuasarRAT malware, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: Florian Roth Rule: INDICATOR_SUSPICIOUS_GENInfoStealer, Description: Detects executables containing common artifcats observed in infostealers, Source: C:\Users\user\AppData\Local\Temp\Client-built.exe, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	5
Start time:	12:42:35
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe"
Imagebase:	0x400000
File size:	72'005'560 bytes
MD5 hash:	D15511E4B90CC6729FEDAF86D080D1F6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	12:42:38
Start date:	09/12/2024
Path:	C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe"
Imagebase:	0x400000
File size:	71'272'344 bytes
MD5 hash:	8318FC63158C01368AADC6D4BE89FAD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	12:42:46
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\schtasks /Create /TN TVInstallRestore /TR "\"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe\" /RESTORE" /RU SYSTEM /SC ONLOGON /F
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	12:42:46
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	12:42:47
Start date:	09/12/2024
Path:	C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe
Wow64 process (32bit):	true
Commandline:	"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE
Imagebase:	0x400000
File size:	71'272'344 bytes
MD5 hash:	8318FC63158C01368AADC6D4BE89FAD1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 0%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	12:43:06
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	12:43:06
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	12:43:16
Start date:	09/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\schtasks /Delete /TN TVInstallRestore /F
Imagebase:	0x840000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	12:43:16
Start date:	09/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	12.7%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	11.3%
Total number of Nodes:	53
Total number of Limit Nodes:	2

Callgraph

Executed
Not Executed
Opacity -> Relevance
Disassembly available

Executed Functions

Function 04E0AA57 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 04E0AAD7

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 7c84c0be9812aac04a34da1d8287fd35966cfd75743d3138785fd63a34f10250
Instruction ID: 686dc81ccbd1ccc992b352fc02ba01e4cf9c0524243e031440ed08b3a1a80216
Opcode Fuzzy Hash: 7c84c0be9812aac04a34da1d8287fd35966cfd75743d3138785fd63a34f10250
Instruction Fuzzy Hash: 1E21D1756097849FEB228F25DC44B52BFB4EF16314F0884EAE9858B1A3D231A948CB61

Function 04E0AA8E Relevance: 1.6, APIs: 1, Instructions: 52
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

AdjustTokenPrivileges.KERNELBASE(?,?,?,?,?,?), ref: 04E0AAD7

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: AdjustPrivilegesToken
String ID:
API String ID: 2874748243-0
Opcode ID: 3fd22e49419b20d615c7486857ddb38d597cdacd0d9568cc700ebfbe2e1dfcb4
Instruction ID: ce586069ef1a34850aab8a04da4802f7dba30bc3cf60f62d37063437679e57cb
Opcode Fuzzy Hash: 3fd22e49419b20d615c7486857ddb38d597cdacd0d9568cc700ebfbe2e1dfcb4
Instruction Fuzzy Hash: 2411A0326003449FEB20CF55D884B66FBE4EF04224F08C47ADD968B692D331E458DF61

Function 04E0B2C7 Relevance: 1.6, APIs: 1, Instructions: 98
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 04E0B37D

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: ce3ee9f5a3bb222d00a05df83e4e09c944f8c4b439db783bc618de4276b6795b
Instruction ID: 00640537a8d12b980a9f6b61ded1aaf1b5f4fcfdc2405c6ac50ff81527a9dab6
Opcode Fuzzy Hash: ce3ee9f5a3bb222d00a05df83e4e09c944f8c4b439db783bc618de4276b6795b
Instruction Fuzzy Hash: 11317EB1505380AFE722CF65DC45F62BFE8EF06214F08849AE9858B6A2D365E509CB71

Function 04E0ACC4 Relevance: 1.6, APIs: 1, Instructions: 87
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcessModules.KERNEL32(?,00000E30,D3C78F61,00000000,00000000,00000000,00000000), ref: 04E0AD5E

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: f025ec3d66107ea997dc0e59e7e0d4bfa15a8ce2ae9e19fe273f3cd2d637ba25
Instruction ID: 68df778fcbb563f8249aa530468ab2b5533c0ed557eddd19c53d3a5946ef20db
Opcode Fuzzy Hash: f025ec3d66107ea997dc0e59e7e0d4bfa15a8ce2ae9e19fe273f3cd2d637ba25
Instruction Fuzzy Hash: 99210A725097806FD7228F60DC44B96BFB8EF46324F0884EBE984DF193C265A949CB75

Function 04E0ADBD Relevance: 1.6, APIs: 1, Instructions: 82
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32(?,00000E30,D3C78F61,00000000,00000000,00000000,00000000), ref: 04E0AE4E

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: 17dea0c8f073f4e10daf817ef5994980335f112e4254933ae3d167e1e05a37f5
Instruction ID: 9d1a4d76d0cf8d3a3b932dc86f14953941f8a68b6b3a54a7bea035cc00a2ff3e
Opcode Fuzzy Hash: 17dea0c8f073f4e10daf817ef5994980335f112e4254933ae3d167e1e05a37f5
Instruction Fuzzy Hash: 5821B7715053846FE722CF51CC44FA6BFB8EF46314F0884AAE985DB152D264E949CB71

Function 04E0AEB4 Relevance: 1.6, APIs: 1, Instructions: 81
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000E30,?,?), ref: 04E0AF5A

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: b2031a05e3f6534134da786a6a30cca26480b4862fc985057112626185f76d81
Instruction ID: a12df4e38ba326738ebfc00034658b9abfd7704aef718d3314a64f5f50c89662
Opcode Fuzzy Hash: b2031a05e3f6534134da786a6a30cca26480b4862fc985057112626185f76d81
Instruction Fuzzy Hash: F021BF715093C06FD312CB65CC55B66BFB4EF87210F0984DBD884DB6A3D624A909CBB2

Function 04E0B2FE Relevance: 1.6, APIs: 1, Instructions: 76
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNELBASE(?,?,?,?,?,?), ref: 04E0B37D

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: CreateFile
String ID:
API String ID: 823142352-0
Opcode ID: 98a5e90e541bf13782a2a32547d1399bd2986dd07e4af1f1c02ebc08591d01e7
Instruction ID: 95c1c19212bc60b268c2ceb829d0bdda64b8e7097b1dcc37681062822ad48d91
Opcode Fuzzy Hash: 98a5e90e541bf13782a2a32547d1399bd2986dd07e4af1f1c02ebc08591d01e7
Instruction Fuzzy Hash: A8218171600240AFE720CFA5DC85BA6FBE8FF04224F188469E9858B691D375F548CB72

Function 04E0B3D4 Relevance: 1.6, APIs: 1, Instructions: 75
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileType.KERNELBASE(?,00000E30,D3C78F61,00000000,00000000,00000000,00000000), ref: 04E0B469

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 72c8c9464e6451eadc3364dcb5de2871c5cf09463807ce5975f4482b7cb44fb4
Instruction ID: 4b522489cb366a27584ece0892379a1c78125fa06b51dfc2bc2fa971d7b78e14
Opcode Fuzzy Hash: 72c8c9464e6451eadc3364dcb5de2871c5cf09463807ce5975f4482b7cb44fb4
Instruction Fuzzy Hash: 1E2129B55087806FE7228F15DC44BA3BFBCEF46724F0880DAE9858B193D224A909C775

Function 04E0B4A4 Relevance: 1.6, APIs: 1, Instructions: 75
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E30,D3C78F61,00000000,00000000,00000000,00000000), ref: 04E0B535

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 3441eb6d1580e4d80a9a223e1aa75706f046efaee39c2a0bd93d08dab2a8d1de
Instruction ID: 1a1ed293365fc35b6c898dc99adef9767a825d4464430a571a58cba973c402d1
Opcode Fuzzy Hash: 3441eb6d1580e4d80a9a223e1aa75706f046efaee39c2a0bd93d08dab2a8d1de
Instruction Fuzzy Hash: 0821A171509380AFD7228F61DC44FA6BFB8EF46314F0884DBE9849B553C225A509CB76

Function 04E0ADEA Relevance: 1.6, APIs: 1, Instructions: 67
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32GetModuleInformation.KERNEL32(?,00000E30,D3C78F61,00000000,00000000,00000000,00000000), ref: 04E0AE4E

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: InformationModule
String ID:
API String ID: 3425974696-0
Opcode ID: af0ccf40efdc4e4c4c3b2f691c7cee6f09cbb9b9adfa8e886b05eb6eda74020c
Instruction ID: a4a82eb7aededc5d809182ed172e09f71f692c347980fc4d7b0fbde9d14ce353
Opcode Fuzzy Hash: af0ccf40efdc4e4c4c3b2f691c7cee6f09cbb9b9adfa8e886b05eb6eda74020c
Instruction Fuzzy Hash: 3511AF72600304AFEB20CF55DC85FA6B7A8EF54224F04C46AE945CB691D374E5898BB6

Function 04E0A84B Relevance: 1.6, APIs: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 04E0A8BA

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: ca64130808d556eda7bef0a5a83371fb4f2fcf9dcc149489d94e32196a12adee
Instruction ID: b18a68405ef1b46fbcc52bfa8138400e9849a26eb94247a7fd53e74895392f4d
Opcode Fuzzy Hash: ca64130808d556eda7bef0a5a83371fb4f2fcf9dcc149489d94e32196a12adee
Instruction Fuzzy Hash: AF21B4716093849FDB21CF25CC44B52BFA8EF16214F0884AAED45DB252D235E444CB71

Function 04E0AD02 Relevance: 1.6, APIs: 1, Instructions: 63
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

K32EnumProcessModules.KERNEL32(?,00000E30,D3C78F61,00000000,00000000,00000000,00000000), ref: 04E0AD5E

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: EnumModulesProcess
String ID:
API String ID: 1082081703-0
Opcode ID: e53773c46d5a4529066e8847b436257b0481343fd2992bbcfe8fa873226a783a
Instruction ID: f4c4fa3fe8a2b3d5125193cd83b5f9fb4276f7eb52664e10ba72da604a50974f
Opcode Fuzzy Hash: e53773c46d5a4529066e8847b436257b0481343fd2992bbcfe8fa873226a783a
Instruction Fuzzy Hash: EB110872600304AFEB20CF55DC45BAAF7A8EF44328F04C46AED45CB651D374A548CBB6

Function 04E0B640 Relevance: 1.6, APIs: 1, Instructions: 60
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

ShellExecuteExW.SHELL32(?), ref: 04E0B69C

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 240811ae7a7372c385469e25da19dde8cf60180350b83efdea34bf4afc8035d6
Instruction ID: 949807f490cd98c9041ba532d24a655f59302e769c706d4e003eb8839d1b5ffd
Opcode Fuzzy Hash: 240811ae7a7372c385469e25da19dde8cf60180350b83efdea34bf4afc8035d6
Instruction Fuzzy Hash: 5611B6716093805FD711CF25DC54B52BFB4EF06224F08C4EAED85CF292D265E548CB61

Function 04E0B4D6 Relevance: 1.6, APIs: 1, Instructions: 60
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

WriteFile.KERNELBASE(?,00000E30,D3C78F61,00000000,00000000,00000000,00000000), ref: 04E0B535

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 75c29c5b7ee7a495edfc4077e0b4928fb1b912ec167e9d179c8ffdea63817e76
Instruction ID: e34be136e25cf026c44cfff79fe6a4e2f08884ed32a72d9338e9112587dadae8
Opcode Fuzzy Hash: 75c29c5b7ee7a495edfc4077e0b4928fb1b912ec167e9d179c8ffdea63817e76
Instruction Fuzzy Hash: 4E11E272A00200AFEB218F91DC44BA6FBA8EF04324F04C49AE9859B651D335F148CBB6

Function 04E0A872 Relevance: 1.6, APIs: 1, Instructions: 53
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

LookupPrivilegeValueW.ADVAPI32(?,?,?), ref: 04E0A8BA

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: LookupPrivilegeValue
String ID:
API String ID: 3899507212-0
Opcode ID: 7a4e3b539ee52dfe9cc60fdad3c193a2ce537e2a3e451d0587f9d3fc8ee12d8e
Instruction ID: a88b801e8331e0db06f9fc92ea5f8623b74057d4468af511d2c25851e05eed49
Opcode Fuzzy Hash: 7a4e3b539ee52dfe9cc60fdad3c193a2ce537e2a3e451d0587f9d3fc8ee12d8e
Instruction Fuzzy Hash: 7D1182727003448FEB20CF29D889756FBD8EF14224F08C47ADD55DB682E275E545CA71

Function 04E0B416 Relevance: 1.6, APIs: 1, Instructions: 52COMMON

Download Yara Rule

APIs

GetFileType.KERNELBASE(?,00000E30,D3C78F61,00000000,00000000,00000000,00000000), ref: 04E0B469

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: FileType
String ID:
API String ID: 3081899298-0
Opcode ID: 2b26e41f6c352456de9395919708b28e2b116a96ba9dd779cb577bb40b671619
Instruction ID: 931a4abad34e1aad96b7087627b5fb86d9dc2add366797f2f8ebe15c6b36fcf0
Opcode Fuzzy Hash: 2b26e41f6c352456de9395919708b28e2b116a96ba9dd779cb577bb40b671619
Instruction Fuzzy Hash: 39019671604344AEE720CF55DC85BA6F7A8EF44628F04C056EE458B791E378B548CAB6

Function 04E0A677 Relevance: 1.5, APIs: 1, Instructions: 49COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 04E0A6D4

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: 9b833dd5396d3b7df9c27c0c53f9ceea796394408a4502b09ff6ffaf50d94805
Instruction ID: 01f3fbbfed0627a23cda68c06f60dc1da849e728aa9b89c90cf5ea6ea5206819
Opcode Fuzzy Hash: 9b833dd5396d3b7df9c27c0c53f9ceea796394408a4502b09ff6ffaf50d94805
Instruction Fuzzy Hash: EF11C271509380AFD722CF55DC85A52FFB4EF06220F09C4DADD948B262C279A988CB62

Function 04E0B662 Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

ShellExecuteExW.SHELL32(?), ref: 04E0B69C

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: ExecuteShell
String ID:
API String ID: 587946157-0
Opcode ID: 09baae95417280160db350dc4f4737042a7436c8301dc680f6cf9e5e3870eaf2
Instruction ID: 5819c471d6f1c736526da9eb53a889bde8aa6d859fb9a848257d2a70ea07ab70
Opcode Fuzzy Hash: 09baae95417280160db350dc4f4737042a7436c8301dc680f6cf9e5e3870eaf2
Instruction Fuzzy Hash: 89019271B002448FDB20CF65E8857A6FBE8EF04224F08C4AADD59CF686D275F544CB62

Function 04E0AF0A Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

K32GetModuleBaseNameW.KERNEL32(?,00000E30,?,?), ref: 04E0AF5A

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: BaseModuleName
String ID:
API String ID: 595626670-0
Opcode ID: 8298599cd8162259accf53dfc4e360ac24485eb5be35b851086c393e00e1cf4b
Instruction ID: e06027f548d0237cb5df37726f5e52e528153dcb36d983aab7923da0c67983fe
Opcode Fuzzy Hash: 8298599cd8162259accf53dfc4e360ac24485eb5be35b851086c393e00e1cf4b
Instruction Fuzzy Hash: 0001B171600200AFD310DF16CC46B66FBA8FB88A20F14811AED489BB41D735F515CBE6

Function 04E0A6A2 Relevance: 1.5, APIs: 1, Instructions: 35COMMON

Download Yara Rule

APIs

SetErrorMode.KERNELBASE(?), ref: 04E0A6D4

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: ErrorMode
String ID:
API String ID: 2340568224-0
Opcode ID: f743ecf1020ee08045553a645ecb6ebb8c113cf8a83e57b1532b61139f0e40d0
Instruction ID: 8ed7dea47c7f4e99c9d1a552ef30468978ba2c16f43060c5f53dcebf013af082
Opcode Fuzzy Hash: f743ecf1020ee08045553a645ecb6ebb8c113cf8a83e57b1532b61139f0e40d0
Instruction Fuzzy Hash: D9F0AF356047849FDB20CF15E885761FBA0EF14228F08C4AADD594B796D37AA588CEA2

Function 04E0AB24 Relevance: 1.3, APIs: 1, Instructions: 68COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 04E0AB90

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: b96e16390b2a297246c1c892c2bc44f8313af16ea6f1a4f88f4db2912e9ec5ac
Instruction ID: ec4332d383f8302d7bbd49912feb187d346c0f03bae340f97bd089aa07f18207
Opcode Fuzzy Hash: b96e16390b2a297246c1c892c2bc44f8313af16ea6f1a4f88f4db2912e9ec5ac
Instruction Fuzzy Hash: A921C3725093C05FDB12CF25DC95A92BFB4AF07324F0984DAEC858F663D265A948CB61

Function 04E0A705 Relevance: 1.3, APIs: 1, Instructions: 61COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 04E0A768

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 11020d334340d8291ab95088ab6b6ac35936220d2244e7271645caa1da727100
Instruction ID: a892b3f0c82523c54c09972d626a08a9f61c39b5600bd3921530236a6ea68da6
Opcode Fuzzy Hash: 11020d334340d8291ab95088ab6b6ac35936220d2244e7271645caa1da727100
Instruction Fuzzy Hash: 08117F755093809FD7128F25DC45B52BFB4EF46224F0984EBED85CF263C239A948CB61

Function 04E0AB5E Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 04E0AB90

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: 9dc1f22912ee2bd79e070ccc7f322d59a00643b9937ed8ff7a0cae04e7d119b6
Instruction ID: d58ab83bb951e21b6390dff1509ce51eaa8a35fa11498f3fc1e65ef1aca007ab
Opcode Fuzzy Hash: 9dc1f22912ee2bd79e070ccc7f322d59a00643b9937ed8ff7a0cae04e7d119b6
Instruction Fuzzy Hash: 1101DF726003448FDB10CF59D885B96FBA4EF10224F08C4BADD498B686D275E548CEA2

Function 04E0A736 Relevance: 1.3, APIs: 1, Instructions: 43COMMON

Download Yara Rule

APIs

CloseHandle.KERNELBASE(?), ref: 04E0A768

Memory Dump Source

Source File: 00000000.00000002.2005749105.0000000004E0A000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E0A000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e0a000_lz3EbiqoK4.jbxd

Similarity

API ID: CloseHandle
String ID:
API String ID: 2962429428-0
Opcode ID: af7f3a4b50d1934b3952614ef4fcb6229b1d642b3211fd7ab0c2547231ddc31b
Instruction ID: 770eb009748686a1c05781030786c34908cd5e5f2abf729b974b2e8ad5b10fbe
Opcode Fuzzy Hash: af7f3a4b50d1934b3952614ef4fcb6229b1d642b3211fd7ab0c2547231ddc31b
Instruction Fuzzy Hash: E401DF71A003449FEB108F15D8857A6FBA4EF50224F08C4BADD498F686D279E548CAA2

Function 04E023F4 Relevance: .0, Instructions: 15COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005693770.0000000004E02000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e02000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 609e2c8d6b74898e358f9b19722e7eb0d465902990627452d2d134aabfd428c5
Instruction ID: b512592d95bb5e678cc5c9fbe86171c6cdd0cada437095c187bb3cd96030092f
Opcode Fuzzy Hash: 609e2c8d6b74898e358f9b19722e7eb0d465902990627452d2d134aabfd428c5
Instruction Fuzzy Hash: B1D05E792066D14FD3168A1CC1A8B953BD4AB51708F4694F9AC408B7A3C768E9C1E600

Function 04E023BC Relevance: .0, Instructions: 14COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.2005693770.0000000004E02000.00000040.00000800.00020000.00000000.sdmp, Offset: 04E02000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_4e02000_lz3EbiqoK4.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 79737ee087645f2eea49ca962cf67d6bed51d8f484a452c02213a0715b044c06
Instruction ID: bef22245f47c41acb890b2cc447f8747e8bdf0573dfad4ac9176ffa9d6fd6c50
Opcode Fuzzy Hash: 79737ee087645f2eea49ca962cf67d6bed51d8f484a452c02213a0715b044c06
Instruction Fuzzy Hash: 54D05E342011824BCB15CA0CD6D9F6937D4AB40709F0694E8AC648B7A6C3B8EDC0CA01

Analysis Process: Client-built.exePID: 7464, Parent PID: 7312COMMON

Execution Graph

Execution Coverage:	9.5%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	3
Total number of Limit Nodes:	0

Executed Functions

Function 00007FFD9B9993C1 Relevance: 1.4, Instructions: 1412
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 439a191ebe5cb521ed8c79448adc981a846bcce8f7e8bbdf6f88f5a2f294ecfb
Instruction ID: d2bac09dee88224f3a1521d2f08ce6cc0f92ba532ca408b3465ab7210f0e58a3
Opcode Fuzzy Hash: 439a191ebe5cb521ed8c79448adc981a846bcce8f7e8bbdf6f88f5a2f294ecfb
Instruction Fuzzy Hash: 5F92173171D90D5FEBE8EB6C8469A7977D1FF99310F0500BAE44EC72A6DE24AC428741

Function 00007FFD9B994DC6 Relevance: 1.3, Instructions: 1277
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 299a684ee882f8de244b7a828e3f23e0d0c3db82f76a7721c93e8719f67f7954
Instruction ID: a857dc5725d101e8f9c748c804f9bba9758e2ea7181d877f310472773f484a9a
Opcode Fuzzy Hash: 299a684ee882f8de244b7a828e3f23e0d0c3db82f76a7721c93e8719f67f7954
Instruction Fuzzy Hash: 27929270A19A0D9FDFE8DF58C4A0BA977E2FF58300F5141A8D44DDB2A6DA35E981CB40

Function 00007FFD9B99A7CD Relevance: .9, Instructions: 929
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6ba513d53d0413f4e412727db6353ab3330d4e2811885ee8b4d354a05bd30282
Instruction ID: 24a2606bea9132e9aa438f95a840ab5d206dc45797ae1a277d7da0d1272e53c5
Opcode Fuzzy Hash: 6ba513d53d0413f4e412727db6353ab3330d4e2811885ee8b4d354a05bd30282
Instruction Fuzzy Hash: BE625130718A4D8FEBA8EB2CC4A4B6977E1FF99301F1545B9E44DC72A6DE34E8418B41

Function 00007FFD9B998A61 Relevance: .7, Instructions: 711COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 075c140200d26a45daf06766bcedbef424282bf71c23370cf96ccd40ea208c50
Instruction ID: e4583f62a56d586ab41740d00b32f91532f52a554edc0d8f3e779d6241fde661
Opcode Fuzzy Hash: 075c140200d26a45daf06766bcedbef424282bf71c23370cf96ccd40ea208c50
Instruction Fuzzy Hash: 67228030B19A0D4FEBA8DB6C84A57B977E2FF98340F15417DD44ED32A2DE38A9428741

Function 00007FFD9B995BE1 Relevance: .7, Instructions: 692COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c7942b31c4b09fb68bce84d5c8b4fbbbf71194d62fe962c2eefdd8060e22fbd1
Instruction ID: c87ba4dd9bb292da77daad48766e3bf780ed2f9a77308df1705e4652ff0da6c7
Opcode Fuzzy Hash: c7942b31c4b09fb68bce84d5c8b4fbbbf71194d62fe962c2eefdd8060e22fbd1
Instruction Fuzzy Hash: 28325E70A18A1D8FEBA4EF58C895BA9B7E1FF98300F1145B9D44DD32A5DB34E981CB40

Function 00007FFD9B723525 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 131
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B723607

Strings

H, xrefs: 00007FFD9B72353A

Memory Dump Source

Source File: 00000001.00000002.3140259655.00007FFD9B720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b720000_Client-built.jbxd

Similarity

API ID: DeleteFile
String ID: H
API String ID: 4033686569-2852464175
Opcode ID: f9822e06688fce982a9b86e09d65646b13664133394b0bc3340671ec28aa5034
Instruction ID: 1100ebcb5757951de469b72ef8b3b2a198044e623a31b808f65e1454d84654f2
Opcode Fuzzy Hash: f9822e06688fce982a9b86e09d65646b13664133394b0bc3340671ec28aa5034
Instruction Fuzzy Hash: 1C41163190DB5C8FDB19DF688859AF97BF0FF56310F0542ABD04DC72A2DA24A909C791

Function 00007FFD9B993F3D Relevance: 1.7, Strings: 1, Instructions: 431
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@, xrefs: 00007FFD9B994457

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID: @
API String ID: 0-2766056989
Opcode ID: 78e47e144e32ff4fe9c9cf5cc9ccc24a35417c167c3e455b04988499216312fc
Instruction ID: 0ee52e19dc9548c0e3ee25fcdbb43753ed14954b9f204360cac775a464853b7b
Opcode Fuzzy Hash: 78e47e144e32ff4fe9c9cf5cc9ccc24a35417c167c3e455b04988499216312fc
Instruction Fuzzy Hash: FFD11731B1E74E4FE7B69BA8946537837D1EF46310F1502BED489C72E2DE18AD468342

Function 00007FFD9B723569 Relevance: 1.6, APIs: 1, Instructions: 109
fileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE ref: 00007FFD9B723607

Memory Dump Source

Source File: 00000001.00000002.3140259655.00007FFD9B720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b720000_Client-built.jbxd

Similarity

API ID: DeleteFile
String ID:
API String ID: 4033686569-0
Opcode ID: fffcd31beac6ce42527f6455061f43d8055ed4bce0efdb578f36e77928627d9f
Instruction ID: 20fc210276aa0a1513ff18efcb79679cdf1846605468feb03ad3e9b4e0de892a
Opcode Fuzzy Hash: fffcd31beac6ce42527f6455061f43d8055ed4bce0efdb578f36e77928627d9f
Instruction Fuzzy Hash: 5931B23190CB5C8FDB19DB588859AF9BBF0FF65321F05426BD049D32A2DB74A805CB91

Function 00007FFD9B993451 Relevance: 1.5, Strings: 1, Instructions: 299
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

$_L, xrefs: 00007FFD9B993673

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID: $_L
API String ID: 0-1448256362
Opcode ID: 47ea0e56ec5598f963829d16db0880981eea03d96e341bb0e1e63a6c852ed668
Instruction ID: a1a6140fc5f74cfba8349a4f973b27f0224028b9b6a331e1dd2a685713089eea
Opcode Fuzzy Hash: 47ea0e56ec5598f963829d16db0880981eea03d96e341bb0e1e63a6c852ed668
Instruction Fuzzy Hash: 78911230B1EB4D5FDBB5DFA884656B5B7E1EF58310B0601BED04EC32A2CE29A945C781

Function 00007FFD9B99C349 Relevance: 1.5, Strings: 1, Instructions: 205
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

a$_H, xrefs: 00007FFD9B99C373

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID: a$_H
API String ID: 0-3636341119
Opcode ID: ddcc9af8be03a9fa299775114a27934aab446fb897dd1a9e58835ebd784f1b84
Instruction ID: 9b6232a91449ef91bc699191c123d9340f5957e89932f8f58a825ac094f01a93
Opcode Fuzzy Hash: ddcc9af8be03a9fa299775114a27934aab446fb897dd1a9e58835ebd784f1b84
Instruction Fuzzy Hash: 3D513972B2DE4D1FE7E4EB6844A56B573E2FFA8350B50057ED04EC32E6ED28A9024341

Function 00007FFD9B99D6D4 Relevance: 1.4, Strings: 1, Instructions: 103
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

N$_H, xrefs: 00007FFD9B99D764

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID: N$_H
API String ID: 0-552572439
Opcode ID: b55ad12dd7e3c0a19221a7ebda19fe09862b44f871c8d0b39e5d9df37d03134a
Instruction ID: 09ecb2264c2b19301f3b8a8af9d7017a3b3842fe792231902831c89240edf5f5
Opcode Fuzzy Hash: b55ad12dd7e3c0a19221a7ebda19fe09862b44f871c8d0b39e5d9df37d03134a
Instruction Fuzzy Hash: 14213871B0D6090FE3685E2D686A0B5BBD2EF99714B0542BFE45DC7297EC39AC438381

Function 00007FFD9B992C10 Relevance: .5, Instructions: 504COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f10311ae17ff15b0d523f2ca0ccfdacab6176ef63c09f03054ccde0ebcf7a22a
Instruction ID: f005f0c79716f244c30694afe1f6da5716a3d8ec648f2baa01e3b35d344f769f
Opcode Fuzzy Hash: f10311ae17ff15b0d523f2ca0ccfdacab6176ef63c09f03054ccde0ebcf7a22a
Instruction Fuzzy Hash: 02E14D72B2EA8D4FE7F9DBEC84656A47BD0FF99310B0501BAD04DC71A2DD18AD468341

Function 00007FFD9B999763 Relevance: .4, Instructions: 440COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: cd1433acd0e287cb70ab3b84e79bdcfffd20afdb41b1e40a6d9c96f21715a2f9
Instruction ID: 26d43fe72f0de7b47fe61efcc8cb2cfcd8c779c34442237cf99e90309b2ac46c
Opcode Fuzzy Hash: cd1433acd0e287cb70ab3b84e79bdcfffd20afdb41b1e40a6d9c96f21715a2f9
Instruction Fuzzy Hash: E9D17F3072990D9FDBA8EF6CC4A9A7977D1FF59301B1240B9E44EC72A6DE24EC428741

Function 00007FFD9B99A3D9 Relevance: .4, Instructions: 394COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c13d870079721294d2229393eaa7279e228cc2e34ffbf625466f90d766f44694
Instruction ID: 14408cfe029cc41c511f503f871978bbd28076e172f18dbafbe4644be2a4102f
Opcode Fuzzy Hash: c13d870079721294d2229393eaa7279e228cc2e34ffbf625466f90d766f44694
Instruction Fuzzy Hash: 8EC1B335B18A0D8FDBA8EF68C455BB977E1FF98310F1501BAD44EC32A6DE34A9418B41

Function 00007FFD9B998BD9 Relevance: .4, Instructions: 383COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e2a333ce7c51612b7975a0f07fe1a9a1e10af56fa5e03fa1384cce06f8535a39
Instruction ID: 2857470638de8155a033a4294432e0c6f699d48a0328975c11ca490111e8adb7
Opcode Fuzzy Hash: e2a333ce7c51612b7975a0f07fe1a9a1e10af56fa5e03fa1384cce06f8535a39
Instruction Fuzzy Hash: D9C1C120B1AA0E4FEBA8DB6C84A97B877D1FF54340F55417DD48EC72E3DE28A9468740

Function 00007FFD9B993125 Relevance: .3, Instructions: 342COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 4144d84da14f62499e2778af6805b47350046e45e790dc46f65d46cf470a7282
Instruction ID: c1e28fef073983676dbe1ec5f7e86d301f66999de632ec4b88a5ba25801eeed2
Opcode Fuzzy Hash: 4144d84da14f62499e2778af6805b47350046e45e790dc46f65d46cf470a7282
Instruction Fuzzy Hash: 33A17031B1DA0D9FDBA8EFA8D4616B973E1FF88314F114179D45DD32A2DE35A9028740

Function 00007FFD9B998C28 Relevance: .3, Instructions: 334COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e68c7f99645629bb740cf498cfbf3ef515e182de37173eda38fe47c2b0d2c1c3
Instruction ID: 15e0834d5d6decd8f6d1bffdf87f7743614f102a206b78e76fe5c0bc7b016752
Opcode Fuzzy Hash: e68c7f99645629bb740cf498cfbf3ef515e182de37173eda38fe47c2b0d2c1c3
Instruction Fuzzy Hash: BBA1B420B1EA0D4FEBA8DA6D84A97B877D1FF58340F55417DD48EC32E3DE28A9468740

Function 00007FFD9B998CA8 Relevance: .3, Instructions: 327COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b6d825ac53f77647b3ce54bbdebd51e57f2d4b868cf5359828310bc223c17797
Instruction ID: 0189a80ecdf291a065910adb1f20ac7becde0bddd0ba6b69f779ad4a2c609e52
Opcode Fuzzy Hash: b6d825ac53f77647b3ce54bbdebd51e57f2d4b868cf5359828310bc223c17797
Instruction Fuzzy Hash: A1A1B320B19A0D4FEBA8DB6D84A97B877D2FF58340F55417DD48EC32E3DE28A9468740

Function 00007FFD9B998D58 Relevance: .3, Instructions: 300COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2e81496e70b1ffca2bb0d79136dc0df221132fca00f169606c76fa83927942fe
Instruction ID: 7e22b9356ee548fc1f7566a1d49c60905427f20660a6cfdfbb34f8cb063c30a3
Opcode Fuzzy Hash: 2e81496e70b1ffca2bb0d79136dc0df221132fca00f169606c76fa83927942fe
Instruction Fuzzy Hash: C7918230B19A0D4FEBA8DA5D84A97B873D2FF98340F55417DD88EC32E3DE28A9458740

Function 00007FFD9B998CE3 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a4bb7b849581fca255ad19cb010bba4f1ea1d2768eec9792fe4919dd969e68b8
Instruction ID: 0aa7d6071446ecb1574b9d0090f806eafc5f0bb4d9f72a497d87ba69c1220a82
Opcode Fuzzy Hash: a4bb7b849581fca255ad19cb010bba4f1ea1d2768eec9792fe4919dd969e68b8
Instruction Fuzzy Hash: A3919330B19A0D4FEBA8DA5D84A97B873D2FF98340F55417DD88EC36E3DE28A9458740

Function 00007FFD9B998CC6 Relevance: .3, Instructions: 299COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: abca56a9f769d7412a8fa91603b7c6887259177e8a7d20abf5cf76458201bfce
Instruction ID: 5c93700cabff042060c6bd79d1a09a8ffaaf1791fa44a275660fee9f384b1836
Opcode Fuzzy Hash: abca56a9f769d7412a8fa91603b7c6887259177e8a7d20abf5cf76458201bfce
Instruction Fuzzy Hash: 32919330B19A0D4FEBA8EA5D84A97B873D2FF98340F55417DD48EC32E3DE29A9458740

Function 00007FFD9B998D3B Relevance: .3, Instructions: 298COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7ccf953ddea0fb334b4f6e0e92ce47370908631d8506db9c1a500ab88e203097
Instruction ID: 12f1bfd16e01935c58120c8284769347b26f754f5b42b9759aa1bb4728307aa0
Opcode Fuzzy Hash: 7ccf953ddea0fb334b4f6e0e92ce47370908631d8506db9c1a500ab88e203097
Instruction Fuzzy Hash: 46917430B19A0D4FEBA8DA5D84A97B877D2FF98340F55417DD48EC32E3DE28A9458740

Function 00007FFD9B998BBD Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 393428fa840b5dc3c7f3dd8e4b5c8b037efb471bfb4d7dfbfc8ddf60a1b874f6
Instruction ID: 26e7f5f17188acf719b6044d0d4e19c31a5ecee6d2ab7044534be3f33648aa7d
Opcode Fuzzy Hash: 393428fa840b5dc3c7f3dd8e4b5c8b037efb471bfb4d7dfbfc8ddf60a1b874f6
Instruction Fuzzy Hash: 15917330B19A0D4FEBA8DA5D84A97B877D2FF98340F55417DD88EC32E3DE28A9458740

Function 00007FFD9B998D1D Relevance: .3, Instructions: 297COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c8051559a5790ceaf0cec4e88b870da125b4750c88f27a3b96f0b0a17b243138
Instruction ID: 54a9b6bc0350fb73fc123c2f2b60e9ddf13cdac5db64751ddf2901fce978be69
Opcode Fuzzy Hash: c8051559a5790ceaf0cec4e88b870da125b4750c88f27a3b96f0b0a17b243138
Instruction Fuzzy Hash: 60917330B19A0D4FEBA8DA5D84A97B877D2FF98340F55417DD48EC32E3DE28A9458740

Function 00007FFD9B998D01 Relevance: .3, Instructions: 296COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5536b79815863d64d3d5c957f312e87bac0aa9e272ce0470e8f6524370ef70d4
Instruction ID: 95340b3b52df4e787c27daa6473cb4f32a1fb391dbd14a00fe341492a675402e
Opcode Fuzzy Hash: 5536b79815863d64d3d5c957f312e87bac0aa9e272ce0470e8f6524370ef70d4
Instruction Fuzzy Hash: 3A917330B19A0D4FEBA8DA5D84A97B877D2FF98340F55417DD88EC32E3DE28A9458740

Function 00007FFD9B996FC5 Relevance: .3, Instructions: 291COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dda9842ee37cc24a5b4c2b9aa6700854a994cc499a5ea0b6f61124b0e945ad8c
Instruction ID: 9974d9585255f024f1a77ad5c5f32c8f62cd25b033204f11c298b2610e3eaa5f
Opcode Fuzzy Hash: dda9842ee37cc24a5b4c2b9aa6700854a994cc499a5ea0b6f61124b0e945ad8c
Instruction Fuzzy Hash: A2715A3171D94D0FE7A8EB6C986967537D1EF9A320B0501BAE04EC72A7DD14EC428781

Function 00007FFD9B99D231 Relevance: .2, Instructions: 248COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b14a593d3de56bc7378ac776de2b8fa0f53539ea36d61894f1e143739511bb1a
Instruction ID: 67e07806705623d9cebb5146717b69f247bc6e7a05630ffd2c041cad7fbe854b
Opcode Fuzzy Hash: b14a593d3de56bc7378ac776de2b8fa0f53539ea36d61894f1e143739511bb1a
Instruction Fuzzy Hash: 5B71C47171D94D4FDB98EF6CC4A5AA977E1FFA8305B0501BAE04EC32A6CE24EC018781

Function 00007FFD9B996C31 Relevance: .2, Instructions: 241COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 231af8fffbdd7a733fb058e0fc47a3da430a2d5b92c32d005ef8bd3c7f39eeed
Instruction ID: 2879c582a4f8885a49be4b4ea2d7ddbc69e1aaf251ed183a9484867b37932fb2
Opcode Fuzzy Hash: 231af8fffbdd7a733fb058e0fc47a3da430a2d5b92c32d005ef8bd3c7f39eeed
Instruction Fuzzy Hash: E5610961B2A94D5FE7F4EB6C846267533D2FF99780B4500B9D41EC32E6DE29BC028340

Function 00007FFD9B99BD32 Relevance: .2, Instructions: 232COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5b91ab5015e997c7f4c9ea0b2c711d0bcb62282461078fddb79f3b7fa296b125
Instruction ID: 21f46d7847398a06f6795f52976922ce8b2d82e7d00287c83776460a7edc4c1f
Opcode Fuzzy Hash: 5b91ab5015e997c7f4c9ea0b2c711d0bcb62282461078fddb79f3b7fa296b125
Instruction Fuzzy Hash: 4F61B130A19A4D4FEBA1DB688868AB57BE1FF45304F0A04BAD45EC71A6DA2CAD41C741

Function 00007FFD9B99C15F Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7546fdea5eb458159607487e12a065ec861f34a23fb1cf0b8606dad320cecb65
Instruction ID: 627fad5712a61624989221fa0866533165cd3ef03f3267aec025631c1fe9ab49
Opcode Fuzzy Hash: 7546fdea5eb458159607487e12a065ec861f34a23fb1cf0b8606dad320cecb65
Instruction Fuzzy Hash: 2D51B571B19E494FE7E9AF6C44A56F477D3EF98384B5000BAC41EC32ABDD25AC428700

Function 00007FFD9B9936F5 Relevance: .2, Instructions: 183COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a2de4bcf0ee05d8e1ce45d05f3ef4cb3d8770c4fc192be4aeb86beaaac3d7f1
Instruction ID: f7de57d383d8d6d0a371ca9dc153ca6390644dda637d8cd013ffbafc11706f31
Opcode Fuzzy Hash: 2a2de4bcf0ee05d8e1ce45d05f3ef4cb3d8770c4fc192be4aeb86beaaac3d7f1
Instruction Fuzzy Hash: 3D515930B1DA4D5FEBA4EF6898506757BD0EF56328F11027ED49DC31E6DE19A8028381

Function 00007FFD9B99D495 Relevance: .2, Instructions: 159COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 48c93c92a578de3006182376c82d44d26b6edc9584e395be59652b511c30995c
Instruction ID: 7b2bae098dda74c68e491877e49bffa45e94c8631ed2992aa9e21af206e73b0b
Opcode Fuzzy Hash: 48c93c92a578de3006182376c82d44d26b6edc9584e395be59652b511c30995c
Instruction Fuzzy Hash: 7251E130A09A8D9FDB95DF6CC894AE97BF1FF59304F0545BAE048C72A2CE34A801CB40

Function 00007FFD9B99CACE Relevance: .2, Instructions: 154COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e448a304264601a1757cd0c9509b584cbbfad245f6de194100b8d558d3407bd5
Instruction ID: 68067e712d9c8f7e2a15d84bbb8b39da77272e25c0317b0ba5a9dc0af258aa70
Opcode Fuzzy Hash: e448a304264601a1757cd0c9509b584cbbfad245f6de194100b8d558d3407bd5
Instruction Fuzzy Hash: 75416972A1FE895FD7B9CB6888645643BE0EF54350B0A41BED088C71A3DD18A985C381

Function 00007FFD9B996E69 Relevance: .2, Instructions: 153COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f87ca0ec5ebc72f8c350fd63de35f0b2e3198bb5d187909a3e788992febfc863
Instruction ID: a6c0d7a0b158c58edec600b1e7c623989de97fa931c5fd479ef1b42782311965
Opcode Fuzzy Hash: f87ca0ec5ebc72f8c350fd63de35f0b2e3198bb5d187909a3e788992febfc863
Instruction Fuzzy Hash: 90410821B1E6890FE7929B7C84646757FE1DFA6280B1904FBD48DCB1B3D919A985C301

Function 00007FFD9B994CD5 Relevance: .2, Instructions: 150COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c428cbd8b7ba09b478ff1c0b64197e77a5f32317a58e69ed1f3746551b1f6baf
Instruction ID: ab697627ab55603701a6c823e41e502a4d3401f615fe880285083c4dfcfc3a9a
Opcode Fuzzy Hash: c428cbd8b7ba09b478ff1c0b64197e77a5f32317a58e69ed1f3746551b1f6baf
Instruction Fuzzy Hash: A5412920B2FB8E1FEBE6D76884647A57BD1EF55640F0945BED04CCB2F2DA24AA41C341

Function 00007FFD9B99CD79 Relevance: .1, Instructions: 142COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 611b3161ee72316cb878de89bdb3d83792bd635395067549a35ad0d2f268798b
Instruction ID: 1238a8bfd8c56b0b39e82e8af68b28d109dacd406946f849de02f369db705e88
Opcode Fuzzy Hash: 611b3161ee72316cb878de89bdb3d83792bd635395067549a35ad0d2f268798b
Instruction Fuzzy Hash: 5141B271A0CA4C8FDB49DF5888556A97BF1FF99310F04426FE04DD32A2DB349955CB81

Function 00007FFD9B9920B0 Relevance: .1, Instructions: 140COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: bb80227f9503a2c74dca0dd90ef15f071bc742946b57755e39b36bbab81656f3
Instruction ID: 9cd05fdc322397a85d5c9607224471f5bdbfcd190bbb4e6821843358ec424861
Opcode Fuzzy Hash: bb80227f9503a2c74dca0dd90ef15f071bc742946b57755e39b36bbab81656f3
Instruction Fuzzy Hash: B141EA73B1D5570AE30A7BB8B4E24E537A09F1162474D85F6D0FEC90D7DD1D688042D6

Function 00007FFD9B99CED0 Relevance: .1, Instructions: 135COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 983e1db95c5354bd43b438a9fdceb102d01280f3eece221de0383fa136ec386a
Instruction ID: 734341df675c310fd39318364de1afcd556103ddd06caec4e0dc9a30100702c5
Opcode Fuzzy Hash: 983e1db95c5354bd43b438a9fdceb102d01280f3eece221de0383fa136ec386a
Instruction Fuzzy Hash: 99414C30619A4E9FEBE8DF58C4A1BA937A1FF55304F5500B8E41EC72E2CB29E955C701

Function 00007FFD9B992EC6 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 77c02ab77017702192533c4b52747dec123f956693490cb6c1cee2eb2fe3ffba
Instruction ID: fd2b335bd727629e44b05338ee519c5deb4e3dd0573cdf349280815e3d913e3a
Opcode Fuzzy Hash: 77c02ab77017702192533c4b52747dec123f956693490cb6c1cee2eb2fe3ffba
Instruction Fuzzy Hash: 3B314D72A1FB8E1FD7EA97A844656B077D1EF9A31071541FAC049C71A7DC1AAC46C340

Function 00007FFD9B9928F2 Relevance: .1, Instructions: 119COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 281db89b2f65d2831e491e6f59d4c4470fa5019ce1231af782292b0dc8080511
Instruction ID: 278f589e7dd1acb2dba8e1a04cd5adb46382f83f993ef8a5229a95055ced9c17
Opcode Fuzzy Hash: 281db89b2f65d2831e491e6f59d4c4470fa5019ce1231af782292b0dc8080511
Instruction Fuzzy Hash: EA312821B2EB8D4FE769A7A894B66E637E1EF59300F4101B7D04EC31E7DC286D058392

Function 00007FFD9B993730 Relevance: .1, Instructions: 116COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 760618a7b995aee0acc58ac83b6e0899c69917bea658820ae8d55d5f89065b55
Instruction ID: efcd16a45d56575b278cf112274f6f4d89c0a37c547d9cfc39b1a4faf0d05cd6
Opcode Fuzzy Hash: 760618a7b995aee0acc58ac83b6e0899c69917bea658820ae8d55d5f89065b55
Instruction Fuzzy Hash: 6D31D731B1CA0D5FEBE8FF699455A7533D1EF99314B11017DD85EC32A6EE29AC014381

Function 00007FFD9B99D155 Relevance: .1, Instructions: 100COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7bfbdefa0805055891743ac8f6221203890bf09bbf2ce701056d18f935ca6259
Instruction ID: c51a0b21ece88b4fd7fc9a41301e310fd8b5da691ddef790b66e848afe3e3224
Opcode Fuzzy Hash: 7bfbdefa0805055891743ac8f6221203890bf09bbf2ce701056d18f935ca6259
Instruction Fuzzy Hash: FF31263162E94A6FE7FD826894E467477D0EF45310F1A40B9C44EC71A2DE18EA818741

Function 00007FFD9B9975E8 Relevance: .1, Instructions: 95COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 380b92ff772fb564b2cfe8049d9e36caf100c5e859495af3ba562b39ee312e5f
Instruction ID: f4c4c9486fead540bb6c8bb78d6906ef3c92d9017d8505fd78ade9503b99550d
Opcode Fuzzy Hash: 380b92ff772fb564b2cfe8049d9e36caf100c5e859495af3ba562b39ee312e5f
Instruction Fuzzy Hash: 89215B23B2FE0D1BE3F8A69D58995B537C1EF9876075602BAD05DC3297DD18BC428382

Function 00007FFD9B9975F0 Relevance: .1, Instructions: 91COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9d24839afebbc7115e5fb87dffbba5754931bc7115acf3c12d9ef947fc7e7dc5
Instruction ID: f47f6da52581eeba6ee27f6bdfb7e69f15f49f55c65b0f43515db313a637d0b4
Opcode Fuzzy Hash: 9d24839afebbc7115e5fb87dffbba5754931bc7115acf3c12d9ef947fc7e7dc5
Instruction Fuzzy Hash: 6B115023B2ED0D1FE3F8A65C58994B537C1EB9836075601B9D05DC3296DD18FC428281

Function 00007FFD9B993140 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7767270f6f9b03cf30d18922adf7d463a6868b5a352eb6d28d4ac83d879a893b
Instruction ID: 3efc72766d50eb3b68d096be32ffff8777795cf86208d1cd06e2fe8d6af232d9
Opcode Fuzzy Hash: 7767270f6f9b03cf30d18922adf7d463a6868b5a352eb6d28d4ac83d879a893b
Instruction Fuzzy Hash: 2F21DE31A18A4C9FDBA8EF68C4556A977E1FF99315B10417EE00DD32A2CF32E812CB40

Function 00007FFD9B99C466 Relevance: .1, Instructions: 90COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 8af37cd6ed87d7dae54a43a96f394496169a86d00e3632395352ec4240bea295
Instruction ID: ceedc59f24d8dd451224a984d7c9ab9198231af3e69afbcc86f7ecda4ef20b6c
Opcode Fuzzy Hash: 8af37cd6ed87d7dae54a43a96f394496169a86d00e3632395352ec4240bea295
Instruction Fuzzy Hash: 6F216AA2B2DE891FE7D9E76844A67B567E1FFA9300B4400FAD04EC31E3ED18B9064341

Function 00007FFD9B99798D Relevance: .1, Instructions: 85COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e956d54b1c7916e2a71c89868f5fe3de6eb132079f96531e7837dbabac15c4bc
Instruction ID: df69f91b0cd85dfe76ef549bc96728abf7697fd9fbc9f74de6a47aaa59578795
Opcode Fuzzy Hash: e956d54b1c7916e2a71c89868f5fe3de6eb132079f96531e7837dbabac15c4bc
Instruction Fuzzy Hash: 1421683061CA088FDB98DF5D94556A9B7E1FF98311F11117EE48AD3262CF36E8428B41

Function 00007FFD9B992943 Relevance: .1, Instructions: 82COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 757674f61502f942c024537ac654d516e1467b32722bc63dcaebb40a63010c2c
Instruction ID: e4bbd007b053c9080495a65ddd685aea4836be6efcd6d781b342bc8b4f08a01f
Opcode Fuzzy Hash: 757674f61502f942c024537ac654d516e1467b32722bc63dcaebb40a63010c2c
Instruction Fuzzy Hash: E721A421B39A4D4BE7A8A79880A66FA73D1FF58301F40457AD44FC31E7DD29BD064381

Function 00007FFD9B99CCA5 Relevance: .1, Instructions: 75COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b23b43ae983ec13bcaa7b8367b6a945bb959a02059816a38242f635461f6dcd3
Instruction ID: 67427073c151ebe2b5bb121523a72f5113aeeea4a956366716fc41daab86c4fe
Opcode Fuzzy Hash: b23b43ae983ec13bcaa7b8367b6a945bb959a02059816a38242f635461f6dcd3
Instruction Fuzzy Hash: 5511BF1158FACA1FE34657B44C395E13FE4EF8755030E42EBE085CB4A3D84C498A8362

Function 00007FFD9B99D0CD Relevance: .1, Instructions: 69COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 625d6bcd0ac7a3ea65aacdd06362befc3557d56246a481f07614d8d7700db7dc
Instruction ID: 6ff546f3ee23a6ef6781dcc7f7567a855beb8ce376ba26262558d189450781ef
Opcode Fuzzy Hash: 625d6bcd0ac7a3ea65aacdd06362befc3557d56246a481f07614d8d7700db7dc
Instruction Fuzzy Hash: 6711E53168E7C60FC3569BB4C820AD1BBE1EF8B22030941FAD0C9C75A7C96C9887C761

Function 00007FFD9B994C61 Relevance: .0, Instructions: 48COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 151a974b24578f32cba812b31de54bbfa3d0686591c869dab65ebec109d6f213
Instruction ID: dd75c841126230798a4d39aa9d7f38ebbf4a6c3db763bf0d62acd57db7735554
Opcode Fuzzy Hash: 151a974b24578f32cba812b31de54bbfa3d0686591c869dab65ebec109d6f213
Instruction Fuzzy Hash: 4801F92191E7495FD3A3D72884553A57FD1DF85220F0946AED089C61F2D9684BC58382

Function 00007FFD9B99C766 Relevance: .0, Instructions: 45COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 88e2dc0590e8069d945c88c1e1cbf19250d508bed114cb0d22b024a0cc7fd475
Instruction ID: 2fef2a03e735e2db75fa5e1b8f416f0ec3db6dfb4b29d693e97be9e42b1b53c7
Opcode Fuzzy Hash: 88e2dc0590e8069d945c88c1e1cbf19250d508bed114cb0d22b024a0cc7fd475
Instruction Fuzzy Hash: 6A01A762B26D491BD7A8EB3844655B96392FFD43407454479901EC31A6CF19B9064301

Function 00007FFD9B99223A Relevance: .0, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 56f5b85dfed579f35af96aeb8e3c58144758f7a487095bc61288ebe7fdaaa6d1
Instruction ID: 3b1d900ff498b0f889b91bc665ba5ace279e041ff62a6abec6a6246c041d9ced
Opcode Fuzzy Hash: 56f5b85dfed579f35af96aeb8e3c58144758f7a487095bc61288ebe7fdaaa6d1
Instruction Fuzzy Hash: 68F0F62191EACC2FEB6597A884656EA7FF1EF46300F4600EBD45CD71A3CD6967088741

Function 00007FFD9B99340D Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 70cf21d9e70ce76508cf83898484feef363597d488487a1893d6b1d777935134
Instruction ID: b267dac78b12d2631a48d9cf27e86b2e16785f810f5cf4c03aa22c7b5f005163
Opcode Fuzzy Hash: 70cf21d9e70ce76508cf83898484feef363597d488487a1893d6b1d777935134
Instruction Fuzzy Hash: 89F0A77150D60C6FD728EE59EC565EB37A4FF85220F00013AF44D82162E6356962C750

Function 00007FFD9B993020 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 38d2585262725daa979730efab32deb1d064a1fc6ee9edfafff50158a78a9ba7
Instruction ID: 86fe1c9ce20e47585037b6f05bcc943c63195518b1a1940a0cef00a8dd0fc40c
Opcode Fuzzy Hash: 38d2585262725daa979730efab32deb1d064a1fc6ee9edfafff50158a78a9ba7
Instruction Fuzzy Hash: 6AF05921B2DA4D4BE7A4EE3C841027133D1EF5A308B0246B9D48DC71B2DF24EC024380

Function 00007FFD9B9922A9 Relevance: .0, Instructions: 37COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2a7a45360b4fc98c5c6823534bd69491cfb5377dc6bbbf5a62b2e8b7bf7235bb
Instruction ID: c2e7a23d01c611637f163b54b56983f40b2872cefa1b11bba3f686c0e8e9d119
Opcode Fuzzy Hash: 2a7a45360b4fc98c5c6823534bd69491cfb5377dc6bbbf5a62b2e8b7bf7235bb
Instruction Fuzzy Hash: 62F0F631A2E7CC4FE7599BB448661ED7FB1EF56200F4A01E7D449CB0A3DD286A498301

Function 00007FFD9B99CD35 Relevance: .0, Instructions: 30COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f8e4457c3c3fc1525c9ddc21e240758f016513739fffa30d642a14ba9ce13371
Instruction ID: b852453eb843dd40dc152716cdfe7a8cc3aee36079a5541d4bd09ccc3f8d4f3c
Opcode Fuzzy Hash: f8e4457c3c3fc1525c9ddc21e240758f016513739fffa30d642a14ba9ce13371
Instruction Fuzzy Hash: D1E012A2A1F7C96FD7929A394D254953FA0AF17A5071A89EFD085CF0B3E1495C098311

Function 00007FFD9B99C439 Relevance: .0, Instructions: 20COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f1694fde9de1d30ef69c2b1e558b8fa740faababb809aac45f939976f6329b7a
Instruction ID: 548982bd672cbc3bff239818fc2aef765ce725a13f660090bc667a2c2cd71434
Opcode Fuzzy Hash: f1694fde9de1d30ef69c2b1e558b8fa740faababb809aac45f939976f6329b7a
Instruction Fuzzy Hash: 6CD095B3F0D64C07F7D095187C802F8B3D1EB55124F14473FC98842097DC3692058700

Non-executed Functions

Function 00007FFD9B7310D1 Relevance: 2.1, Strings: 1, Instructions: 817COMMON

Download Yara Rule

Strings

,K_^, xrefs: 00007FFD9B731801

Memory Dump Source

Source File: 00000001.00000002.3140259655.00007FFD9B720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b720000_Client-built.jbxd

Similarity

API ID:
String ID: ,K_^
API String ID: 0-111120595
Opcode ID: c8c2d31e9f9143352659a2a8df03cc3e4500c9f32c8ed951d4a13aa229a23e91
Instruction ID: 571b35beba3c6444085c8a392e9b33decd05757b027e928b8a7599641c26c24d
Opcode Fuzzy Hash: c8c2d31e9f9143352659a2a8df03cc3e4500c9f32c8ed951d4a13aa229a23e91
Instruction Fuzzy Hash: 55328D17B0D1A70AE71677BDB8F24EA7BA0DF4223974842F7D0DD8D0D79C0D684A8296

Function 00007FFD9B9911F2 Relevance: 1.6, Strings: 1, Instructions: 355COMMON

Download Yara Rule

Strings

2%_^, xrefs: 00007FFD9B991201

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID: 2%_^
API String ID: 0-4094711381
Opcode ID: 1c08522d166b61aeb77c4ac12bfe8d15787fce6cec6881b6eeac461b8c587a72
Instruction ID: f78a99a83cb760e714180d452cf6776624353bc33e9aaba7a7047cd824b179c7
Opcode Fuzzy Hash: 1c08522d166b61aeb77c4ac12bfe8d15787fce6cec6881b6eeac461b8c587a72
Instruction Fuzzy Hash: 16B17757B195A35AF31A77B8B8F24E63BB09F0222C74D46F2D0EE490D7DD0D29428296

Function 00007FFD9B7310F2 Relevance: .5, Instructions: 519COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3140259655.00007FFD9B720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b720000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 98086f6d335b49afbc45e712cfe979b2e4a9f4c67c91c3e43e26e53c79aef136
Instruction ID: e747e298d644dbb5b17d6995c3fff72440d949d81afd928ca31ee4d39920451a
Opcode Fuzzy Hash: 98086f6d335b49afbc45e712cfe979b2e4a9f4c67c91c3e43e26e53c79aef136
Instruction Fuzzy Hash: 96E15E17B0D1A70AE70677BDB8F64EA7BA0DF4223974842F7D0DD8D0D79C0D684A8296

Function 00007FFD9B7311D3 Relevance: .4, Instructions: 445COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3140259655.00007FFD9B720000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B720000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b720000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683c3747587de2ae85c94fbc68779b6e3e15e3f979868c31a1413c0654e61e2d
Instruction ID: 067fa86c0cb5ad89cdf5a1d3a68b716f4fe70ad88f865b98510a2cb58b543987
Opcode Fuzzy Hash: 683c3747587de2ae85c94fbc68779b6e3e15e3f979868c31a1413c0654e61e2d
Instruction Fuzzy Hash: 49C14C16B0D1A70AE70677BDB8E54EA7FA0DF4223974842F7D0D98D0D79C0D684A8296

Function 00007FFD9B9910D1 Relevance: .4, Instructions: 435COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000001.00000002.3149337918.00007FFD9B990000.00000040.00000800.00020000.00000000.sdmp, Offset: 00007FFD9B990000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_7ffd9b990000_Client-built.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a034d6da37adc31ed9579050e53358d4c88b648a47297bd9c4d93d52d22dde81
Instruction ID: 58b19c8a9d2e625e59e140b7ee1fdfeb662f5c637a3e3b1972bce543aacf0200
Opcode Fuzzy Hash: a034d6da37adc31ed9579050e53358d4c88b648a47297bd9c4d93d52d22dde81
Instruction Fuzzy Hash: 36D15457B1D1A35AF71A77F8A8F24E63BB09F0222C74D46F2D0EE490D7DD0D29428296

Analysis Process: TeamViewer_Setup_x64.exePID: 7772, Parent PID: 7312COMMON

Execution Graph

Execution Coverage:	16.7%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	18.7%
Total number of Nodes:	1288
Total number of Limit Nodes:	28

Executed Functions

Function 004030D9 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 357
stringcomfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004030FE
GetVersion.KERNEL32 ref: 00403104
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 0040312D
#17.COMCTL32(00000007,00000009), ref: 0040314F
OleInitialize.OLE32(00000000), ref: 00403156
SHGetFileInfoA.SHELL32(0041ECC8,00000000,?,00000160,00000000), ref: 00403172
GetCommandLineA.KERNEL32(00422F00,NSIS Error), ref: 00403187
GetModuleHandleA.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,00000000), ref: 0040319A
CharNextA.USER32(00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,00000020), ref: 004031C5
GetTempPathA.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\,00000000,00000020), ref: 004032C2
GetWindowsDirectoryA.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004032D3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032DF
GetTempPathA.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004032F3
lstrcatA.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 004032FB
SetEnvironmentVariableA.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 0040330C
SetEnvironmentVariableA.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403314
DeleteFileA.KERNELBASE(1033), ref: 00403328

Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF

ExitProcess.KERNEL32(?), ref: 004033D1
CoUninitialize.COMBASE(?), ref: 004033D6
ExitProcess.KERNEL32 ref: 004033F7
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403514
OpenProcessToken.ADVAPI32(00000000), ref: 0040351B
LookupPrivilegeValueA.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403533
AdjustTokenPrivileges.ADVAPI32(?,?,?,?,00000000,?,00000000,00000000,00000000), ref: 00403552
ExitWindowsEx.USER32(00000002,80040002), ref: 00403576
ExitProcess.KERNEL32 ref: 00403599

Part of subcall function 004054EF: MessageBoxIndirectA.USER32(00409218), ref: 0040554A

Strings

Error launching installer, xrefs: 0040338E
SeShutdownPrivilege, xrefs: 0040352D
`Kt, xrefs: 00403300
\Temp, xrefs: 004032D9
UXTHEME, xrefs: 00403121, 00403126, 0040312C
Low, xrefs: 004032F5
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040318D, 00403193, 0040334C
C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 004033B3
", xrefs: 004031EA
NSIS Error, xrefs: 00403178
TMP, xrefs: 0040330F
C:\Users\user\AppData\Local\Temp\, xrefs: 004032B7, 004032BC, 004032D2, 004032DE, 004032ED, 004032FA, 00403306, 0040330E, 00403407, 00403418, 00403423, 0040342F, 0040343C, 0040344B, 004034FA
.tmp, xrefs: 0040341E
TEMP, xrefs: 00403307
1033, xrefs: 00403323
C:\Users\user\AppData\Local\Temp, xrefs: 00403429, 0040342E, 0040345A
~nsu, xrefs: 00403402
C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe, xrefs: 004034B4

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Process$Exit$EnvironmentFileHandleModulePathTempTokenVariableWindowslstrcat$AddressAdjustCharCommandCurrentDeleteDirectoryErrorIndirectInfoInitializeLineLookupMessageModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrlen
String ID: "$"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $.tmp$1033$C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe$C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696$Error launching installer$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$`Kt$~nsu
API String ID: 3329125770-980410419
Opcode ID: 4f4e7a4209cacf2233f42e90a73ac4821f0654123dbc60adf3f7537713659d44
Instruction ID: e7c85c4fe1f62676e3f8a08d8ca43f8bf3783ba147aef7bb7f1979754dcbcc24
Opcode Fuzzy Hash: 4f4e7a4209cacf2233f42e90a73ac4821f0654123dbc60adf3f7537713659d44
Instruction Fuzzy Hash: B7C1E5706083417AE711AF71AD8DA2B7EA8EB85306F04457FF541B61D2C77C5A05CB2E

Function 00405D1B Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 199
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(?,0041F4E8,00000000,00404F4A,0041F4E8,00000000), ref: 00405DCC
GetSystemDirectoryA.KERNEL32(004226A0,00000400), ref: 00405E47
GetWindowsDirectoryA.KERNEL32(004226A0,00000400), ref: 00405E5A
SHGetSpecialFolderLocation.SHELL32(?,0040E8C0), ref: 00405E96
SHGetPathFromIDListA.SHELL32(0040E8C0,004226A0), ref: 00405EA4
CoTaskMemFree.OLE32(0040E8C0), ref: 00405EAF
lstrcatA.KERNEL32(004226A0,\Microsoft\Internet Explorer\Quick Launch), ref: 00405ED1
lstrlenA.KERNEL32(004226A0,?,0041F4E8,00000000,00404F4A,0041F4E8,00000000), ref: 00405F23

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 00405E16
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00405ECB

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: fb8208971b7bef3eab874112c295b4c22afd955e6dbc7abb81a1d2e78964ecc6
Instruction ID: 70d043a0125fa0970afc212ad974551980140434863585fcf13b89b4fbf53fe2
Opcode Fuzzy Hash: fb8208971b7bef3eab874112c295b4c22afd955e6dbc7abb81a1d2e78964ecc6
Instruction Fuzzy Hash: AD61F471A04A01ABDF205F64DC88B7F3BA8DB41305F50803BE941B62D0D27D4A82DF5E

Function 0040559B Relevance: 17.7, APIs: 7, Strings: 3, Instructions: 159
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileA.KERNELBASE(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004055C4
lstrcatA.KERNEL32(00420D10,\*.*,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040560C
lstrcatA.KERNEL32(?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 0040562D
lstrlenA.KERNEL32(?,?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405633
FindFirstFileA.KERNELBASE(00420D10,?,?,?,00409014,?,00420D10,?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405644
FindNextFileA.KERNELBASE(00000000,00000010,000000F2,?,?,?,00000000,?,?,0000003F), ref: 004056F1
FindClose.KERNEL32(00000000), ref: 00405702

Strings

\*.*, xrefs: 00405606
C:\Users\user\AppData\Local\Temp\, xrefs: 004055A8
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040559B

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $C:\Users\user\AppData\Local\Temp\$\*.*
API String ID: 2035342205-2696634726
Opcode ID: f4a0432186cec9e524a36939f8e9c58fb2d449d925f7b508e3eb0abb68d19267
Instruction ID: 44541a5d5af4c0b2911f4644f2fa5328a4f1ed3919081d24b86541679c9c03d6
Opcode Fuzzy Hash: f4a0432186cec9e524a36939f8e9c58fb2d449d925f7b508e3eb0abb68d19267
Instruction Fuzzy Hash: 9F51CF30804A04BADF217A658C85BBF7AB8DF82318F54847BF445761D2C73D4982EE6E

Function 00406344 Relevance: 5.4, APIs: 4, Instructions: 382
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
Instruction ID: a8746b25a1c6b49bbeafbf020c2dfcaa04563a9eac1a8e827fb2969916571183
Opcode Fuzzy Hash: e28a8ad83f22bfe4c4d455a141f03dc38bf257c2203b46f6b1d5cba347f55b6d
Instruction Fuzzy Hash: 70F17670D00229CBCF18CFA8C8946ADBBB1FF44305F25816ED856BB281D7786A96CF44

Function 00405FFD Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNELBASE(74DF3410,00421558,C:\,0040589C,C:\,C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 00406008
FindClose.KERNELBASE(00000000), ref: 00406014

Strings

C:\, xrefs: 00405FFD

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\
API String ID: 2295610775-3404278061
Opcode ID: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
Instruction ID: 1297c1e42099762feae64532f60583430090df1d404adb2e37743a0561846f6f
Opcode Fuzzy Hash: fb61142ecab510d9bb051178c92cda44e9a3fae507c1338c77e1024ce068b834
Instruction Fuzzy Hash: 8CD012319491206BC3105B38AD0C85B7A599F593317118A33F567F52F0C7788C7296E9

Function 00403679 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406092: GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
Part of subcall function 00406092: GetProcAddress.KERNEL32(00000000,?), ref: 004060BF

lstrcatA.KERNEL32(1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,74DF3410,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,00000000), ref: 004036F4
lstrlenA.KERNEL32(004226A0,?,?,?,004226A0,00000000,00429400,1033,0041FD08,80000001,Control Panel\Desktop\ResourceLocale,00000000,0041FD08,00000000,00000002,74DF3410), ref: 00403769
lstrcmpiA.KERNEL32(?,.exe), ref: 0040377C
GetFileAttributesA.KERNEL32(004226A0), ref: 00403787
LoadImageA.USER32(00000067,00000001,00000000,00000000,00008040,00429400), ref: 004037D0

Part of subcall function 00405C57: wsprintfA.USER32 ref: 00405C64

RegisterClassA.USER32(00422EA0), ref: 0040380D
SystemParametersInfoA.USER32(00000030,00000000,?,00000000), ref: 00403825
CreateWindowExA.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 0040385A
ShowWindow.USER32(00000005,00000000), ref: 00403890
GetClassInfoA.USER32(00000000,RichEdit20A,00422EA0), ref: 004038BC
GetClassInfoA.USER32(00000000,RichEdit,00422EA0), ref: 004038C9
RegisterClassA.USER32(00422EA0), ref: 004038D2
DialogBoxParamA.USER32(?,00000000,00403A0B,00000000), ref: 004038F1

Strings

.DEFAULT\Control Panel\International, xrefs: 004036DF
.exe, xrefs: 00403776
RichEd20, xrefs: 00403896
_Nb, xrefs: 004037EC, 00403854
C:\Users\user\AppData\Local\Temp\, xrefs: 0040367E
RichEdit20A, xrefs: 004038B4, 004038BA
RichEd32, xrefs: 004038A4
Control Panel\Desktop\ResourceLocale, xrefs: 004036AD
1033, xrefs: 00403699, 004036EF
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040367D
RichEdit, xrefs: 004038C3

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $.DEFAULT\Control Panel\International$.exe$1033$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20A$_Nb
API String ID: 1975747703-3157804261
Opcode ID: 5c13432dcba976acc153c6c4cb0ae4a4ceee92b52a3611d71cd5da1aeea12791
Instruction ID: cdcda0c5d6d895e27caec97b3fe99e3f57ebd92391a3aca4eab7d54baf018be6
Opcode Fuzzy Hash: 5c13432dcba976acc153c6c4cb0ae4a4ceee92b52a3611d71cd5da1aeea12791
Instruction Fuzzy Hash: FA61C8B16442007ED620BF669D45F373AACEB44759F40447FF941B22E2C77CAD029A2D

Function 00402C66 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 182
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402C77
GetModuleFileNameA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,00000400), ref: 00402C93

Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 00405970
Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992

GetFileSize.KERNEL32(00000000,00000000,0042B000,00000000,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 00402CDF

Strings

Error launching installer, xrefs: 00402CB6
soft, xrefs: 00402D54
C:\Users\user\AppData\Local\Temp\, xrefs: 00402C6D
Inst, xrefs: 00402D4B
Null, xrefs: 00402D5D
C:\Users\user\AppData\Local\Temp, xrefs: 00402CC1, 00402CC6, 00402CCC
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 00402C66
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error, xrefs: 00402E3E
C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe, xrefs: 00402C7D, 00402C8C, 00402CA0, 00402CC0

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$AttributesCountCreateModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe$Error launching installer$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author to obtain a new copy.More information at:http://nsis.sf.net/NSIS_Error$Null$soft
API String ID: 4283519449-965790605
Opcode ID: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
Instruction ID: 1839f4375b44da3097aca9d4a8c6c84b0463c2d100b7a2d698c12080187f488f
Opcode Fuzzy Hash: 3f665217ac2245ad92c498c6fa1e551097c863ebe5e03bc44dd447b4a8322165
Instruction Fuzzy Hash: BF51B6B1A41214ABDF109F65DE89B9E7AB4EF00355F14403BF904B62D1C7BC9E418B9D

Function 00401751 Relevance: 14.1, APIs: 5, Strings: 3, Instructions: 147
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatA.KERNEL32(00000000,00000000,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,00000000,00000000,00000031), ref: 00401790
CompareFileTime.KERNEL32(-00000014,?,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,00000000,00000000,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,00000000,00000000,00000031), ref: 004017BA

Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06

Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE

Strings

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 0040176D, 00401776, 00401783, 00401795, 004017A6, 004017DC, 004017F2, 00401810, 00401850, 004018D1, 004018DA, 004018E4, 004018EF
C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 0040177E
C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\, xrefs: 0040181E, 0040183A

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696$C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696$C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\
API String ID: 1941528284-1365137416
Opcode ID: 44ecab9e1ef5e24c1ff596ae454948ee53cb588ab7073804ea6e55edc91cb487
Instruction ID: dfa66b7161a0f16b13ad00a25904a83b243dedeb6ee7557d1be3b523159fd244
Opcode Fuzzy Hash: 44ecab9e1ef5e24c1ff596ae454948ee53cb588ab7073804ea6e55edc91cb487
Instruction Fuzzy Hash: 5641D572910515BACF107BB5CC85EAF3679EF45329B20823BF521F20E2D63C4A419B6D

Function 004053D8 Relevance: 14.0, APIs: 4, Strings: 4, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B
GetLastError.KERNEL32 ref: 0040542F
SetFileSecurityA.ADVAPI32(?,80000007,00000001), ref: 00405444
GetLastError.KERNEL32 ref: 0040544E

Strings

ts@, xrefs: 004053DE
C:\Users\user\AppData\Local\Temp\, xrefs: 004053FE
ds@, xrefs: 0040540D
C:\Users\user\AppData\Local\Temp, xrefs: 004053D8

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp$C:\Users\user\AppData\Local\Temp\$ds@$ts@
API String ID: 3449924974-3456956737
Opcode ID: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction ID: 5d613d5f07efa900d759e60f8f8ec78c4c71b6ffd2fe208e339ff175f81ef67f
Opcode Fuzzy Hash: f69d3160a82a2859f106a017fa20b71bd819ec85ae22b078452fa26fbc967781
Instruction Fuzzy Hash: F3010871D14259EADF119FA0D9487EFBFB8EB04315F00417AE904B6280D378A644CFAA

Function 00406024 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603B
wsprintfA.USER32 ref: 00406074
LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088

Strings

%s%s.dll, xrefs: 0040606E
UXTHEME, xrefs: 0040602D
\, xrefs: 0040604C

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%s.dll$UXTHEME$\
API String ID: 2200240437-4240819195
Opcode ID: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction ID: 72752c577983536edbae7b7a4b2c1439e1101fa4b93fa8d0208d5a4e16dde88a
Opcode Fuzzy Hash: 38f932dad6d10820f3564912fa7e39c047c8ada2afd73a6a353afcde48b08f1a
Instruction Fuzzy Hash: E6F0FC30A40109AADB14E764DC0DFEB365CAB09305F140576A546E11D1D578E9258B69

Function 00402E9F Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 155
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402EFD
GetTickCount.KERNEL32 ref: 00402F7E
MulDiv.KERNEL32(7FFFFFFF,00000064,00000020), ref: 00402FAB
wsprintfA.USER32 ref: 00402FBB

Strings

... %d%%, xrefs: 00402FB5

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CountTick$wsprintf
String ID: ... %d%%
API String ID: 551687249-2449383134
Opcode ID: fb8bdaecb8610db7079700bd5469a99c5e74861b297f6c97a10e9c8668abb65b
Instruction ID: 4ab2a5a1bcd3fb7fa9d72e81aa521510b391fe67da8672e6f00875cd24a8b3cf
Opcode Fuzzy Hash: fb8bdaecb8610db7079700bd5469a99c5e74861b297f6c97a10e9c8668abb65b
Instruction Fuzzy Hash: 7D518F729022199BDF10DF65DA08A9F7BB8AF40795F14413BF800B72C4C7789E51DBAA

Function 0040599B Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 33
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 004059AF
GetTempFileNameA.KERNELBASE(?,?,00000000,?), ref: 004059C9

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040599E
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040599B
nsa, xrefs: 004059A6

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-337437966
Opcode ID: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction ID: 3a3981258a6ccd3f3c7180c2fb01dffc681fdc90015df490a153c8b64b3610b8
Opcode Fuzzy Hash: a71f6d19a672690ae76045f6a92713abfaab32ef542e638d1cc3651a1fbf987a
Instruction Fuzzy Hash: 6DF08276708214ABEB108F55EC04B9B7B9CDF91760F10C03BFA48DA190D6B599548B99

Function 00405859 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 46
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405CF9: lstrcpynA.KERNEL32(?,?,00000400,00403187,00422F00,NSIS Error), ref: 00405D06

Part of subcall function 00405804: CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B

lstrlenA.KERNEL32(C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 004058AC
GetFileAttributesA.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\), ref: 004058BC

Strings

C:\, xrefs: 0040585F, 00405864, 0040586A, 004058A5, 004058AB, 004058B3, 004058BB
C:\Users\user\AppData\Local\Temp\, xrefs: 00405859

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\$C:\Users\user\AppData\Local\Temp\
API String ID: 3248276644-3049482934
Opcode ID: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
Instruction ID: 1d2993da53655c0900dfa7f8eb6ffa86a16769ab8224128061af08a25d69d353
Opcode Fuzzy Hash: 2f5f7bd10b83e5c994280ddce28bb3e0edcf250d71028fabecdb2709bf5dd46b
Instruction Fuzzy Hash: 16F0F427105E5165DA22323B1C05B9F1A44CD86354718C53BFC51F22D2DA3CC8629DBE

Function 00401F90 Relevance: 6.1, APIs: 4, Instructions: 73
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleHandleA.KERNELBASE(00000000,00000001,000000F0), ref: 00401FBB

Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE

LoadLibraryExA.KERNELBASE(00000000,?,00000008,00000001,000000F0), ref: 00401FCB
GetProcAddress.KERNEL32(00000000,?), ref: 00401FDB
FreeLibrary.KERNELBASE(00000000,00000000,000000F7,?,?,00000008,00000001,000000F0), ref: 00402045

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$AddressFreeHandleLoadModuleProcTextWindowlstrcat
String ID:
API String ID: 2987980305-0
Opcode ID: c9236aab3ecf390f27b0d2df40a3eeaa529cc51138fd025aa611fd94b365db02
Instruction ID: 033e4e5f5e4c037d50d2464c5542d6b5672e4837e9f8cb01fb8d89ff16108e1c
Opcode Fuzzy Hash: c9236aab3ecf390f27b0d2df40a3eeaa529cc51138fd025aa611fd94b365db02
Instruction Fuzzy Hash: 1A212B72904211FBDF217FA48E49AAE76B1AB45318F30423BF701B62D0C7BD49459A6E

Function 004015B3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 66
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00405804: CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 00405817
Part of subcall function 00405804: CharNextA.USER32(00000000), ref: 0040582B

GetFileAttributesA.KERNELBASE(00000000,00000000,00000000,0000005C,00000000,000000F0), ref: 00401605

Part of subcall function 004053D8: CreateDirectoryA.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 0040541B

SetCurrentDirectoryA.KERNELBASE(00000000,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,00000000,00000000,000000F0), ref: 00401634

Strings

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 00401629

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696
API String ID: 1892508949-3053395492
Opcode ID: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
Instruction ID: 4fb2b9239308f527e4829455642bf5c86be9504270dcf99fcce102751257b2ff
Opcode Fuzzy Hash: dc3f2b08dd0b23deb2200b8cff6eb9b6ab41173e829b03834ce904b4ad95c354
Instruction Fuzzy Hash: 1611E736508141ABEF217F650D415BF27B0EA92325738467FE592B62E2C63C4942A63F

Function 0040548A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
CloseHandle.KERNEL32(?), ref: 004054C0

Strings

Error launching installer, xrefs: 0040549D

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
Instruction ID: 90ee3f3d0c484d323fd0424032eb65db2415cafeee3384e03f1d9bc4b04e7a5d
Opcode Fuzzy Hash: 8c32d595c10ae78cfc35805ab98709760fd6cf99201592758dbf5461ff55bb51
Instruction Fuzzy Hash: FFE04FB4A002097FEB009B60EC05F7B7BBCEB00348F408561BD11F21A0E374A9508A78

Function 00406779 Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
Instruction ID: ac331763182a67db8ffe8b732b67c8974d54266b30473341b06133cd37c0d4bc
Opcode Fuzzy Hash: b4bbaf917c5b2b4b29eca7dd879fe0279583c9caa0a8680a3fb668f2eecfa979
Instruction Fuzzy Hash: ECA13171E00229CBDF28DFA8C8547ADBBB1FB44305F11816ED816BB281C7786A96CF44

Function 0040697A Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
Instruction ID: e89747aace1fce0fcb13a8d80e6f88749465aa03c559881c8099c8d07fdfb4d2
Opcode Fuzzy Hash: db4b2f824491321a50731860d46817135270c8e97721ba662834ece50dc26027
Instruction Fuzzy Hash: BE911070E04228CBDF28DF98C8547ADBBB1FB44305F15816ED816BB281C778AA96DF44

Function 00406690 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
Instruction ID: d456333056e0522eb9a81365918d8492ce98a85054e5b278218ea4b7938feab7
Opcode Fuzzy Hash: adca5b2b6989107afceee3a061708c38461c5fc9fc0daf484043dfdf7e09805a
Instruction Fuzzy Hash: E1814671D04228CFDF24CFA8C8847ADBBB1FB44305F25816AD416BB281C778AA96DF44

Function 00406195 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
Instruction ID: 4327eab70650ef0c96a691b493921a8ab8e5ba0d824f916f670fcb6a13d6a8f8
Opcode Fuzzy Hash: 5bfff9db2859b877ca6a77ec9405565887134ef839be144d68b3806b8d7c08ac
Instruction Fuzzy Hash: 11816671D04228DBDF24CFA8C8447ADBBB1FB44315F2181AED856BB281C7786A96DF44

Function 004065E3 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
Instruction ID: 63ee65aff5d1ea53a99bb7455827a561e54e570c364fe5978cc4b9ff32097947
Opcode Fuzzy Hash: 2f3dabd0af62f4e8bfcd4b659d73a5ba33a7939e144f292b7bb16ba2439e66e8
Instruction Fuzzy Hash: E9711271D04228CBDF24CFA8C8547ADBBF1FB48305F15806AD856BB281D7786A96DF44

Function 00406701 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
Instruction ID: 2ec41c1936be718984cf19d05ce660ecedc56656b80368bbb2ce29215557a5c8
Opcode Fuzzy Hash: 83d4d9fa97144311a3e66a470cde7927608ab55fe6dc8c436fded4a10c430ead
Instruction Fuzzy Hash: 53712571E04228CBDF28CF98C854BADBBB1FB44305F15816ED856BB281C7785996DF44

Function 0040664D Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
Instruction ID: 94740bf10ed9628fc2a816943eb7322e71ed29eec5e37d1a6fe0f7c23d4f3e83
Opcode Fuzzy Hash: 1b21a4910564614c6641403ac362d6aa440f40f6368f9ee5d1983abbc3d5a3b8
Instruction Fuzzy Hash: 1D714571E04228CBDF28CF98C854BADBBB1FB44305F11806ED856BB281C7786A96DF44

Function 00401E44 Relevance: 4.5, APIs: 3, Instructions: 48synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 00404F12: lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
Part of subcall function 00404F12: lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
Part of subcall function 00404F12: lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
Part of subcall function 00404F12: SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
Part of subcall function 00404F12: SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
Part of subcall function 00404F12: SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
Part of subcall function 00404F12: SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE

Part of subcall function 0040548A: CreateProcessA.KERNELBASE(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00421510,Error launching installer), ref: 004054B3
Part of subcall function 0040548A: CloseHandle.KERNEL32(?), ref: 004054C0

WaitForSingleObject.KERNEL32(?,00000064,00000000,000000EB,00000000), ref: 00401E7E
GetExitCodeProcess.KERNELBASE(?,?), ref: 00401E8E
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EB3

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$CloseHandleProcesslstrlen$CodeCreateExitObjectSingleTextWaitWindowlstrcat
String ID:
API String ID: 3521207402-0
Opcode ID: 7baa4545988b071bf1f27952e090968b1b6e0d745a44be253271fef70d106577
Instruction ID: 49f7d359c4d218189077cc8fb8a526ed56d4096950e75cb47e310611910bd6fc
Opcode Fuzzy Hash: 7baa4545988b071bf1f27952e090968b1b6e0d745a44be253271fef70d106577
Instruction Fuzzy Hash: C4016D31904104EBDF11AFA1C984A9E77B2EF00354F10817BFA01B52E1C7785A85AB9A

Function 00405553 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405947: GetFileAttributesA.KERNELBASE(?,?,0040555F,?,?,00000000,00405742,?,?,?,?), ref: 0040594C
Part of subcall function 00405947: SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405960

RemoveDirectoryA.KERNELBASE(?,?,?,00000000,00405742), ref: 0040556E
DeleteFileA.KERNELBASE(?,?,?,00000000,00405742), ref: 00405576
SetFileAttributesA.KERNEL32(?,00000000), ref: 0040558E

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 17f562840c1773a82e66d36c699c3ba4858698b3520e1b3e97930180dfe60130
Instruction ID: 364b991763a9b947ff98ca2783b3bb2cd1a0068a6ee853e10d07d538a8c3989e
Opcode Fuzzy Hash: 17f562840c1773a82e66d36c699c3ba4858698b3520e1b3e97930180dfe60130
Instruction Fuzzy Hash: 6CE0E531519A91B6C61057309C08F5F2AD6EFCA338F040A36F891B21C4C33C88068E7E

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageA.USER32(?,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction ID: da56ad7cfcb2a9fecb994a09e4a0bd113f750103611445cd7b28aada07ee45e3
Opcode Fuzzy Hash: a519dadb84f5fbb5742ded63e05e15cde03a873041ee9604df24846d4002906c
Instruction Fuzzy Hash: 2E012831B24210ABE7294B389D04B6A369CE710328F11823BF811F72F1D6B8DC42DB4D

Function 00406092 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,?,00403143,00000009), ref: 004060A4
GetProcAddress.KERNEL32(00000000,?), ref: 004060BF

Part of subcall function 00406024: GetSystemDirectoryA.KERNEL32(?,00000104), ref: 0040603B
Part of subcall function 00406024: wsprintfA.USER32 ref: 00406074
Part of subcall function 00406024: LoadLibraryExA.KERNELBASE(?,00000000,00000008), ref: 00406088

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction ID: f390ed2799c289b087c769a87f24dfac638062b8da6604b2acd18c4b1555f769
Opcode Fuzzy Hash: ad31075058678b318fb1acd60a85244af91915838e2bda58b2d8d9f4dd3fd24d
Instruction Fuzzy Hash: B4E08632644111A6D320A7709D0493B72EC9E84710302483EF906F2191D738AC259669

Function 0040596C Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 00405970
CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction ID: 2848333a8a5b20597e43067d17cc290ce391feab13c7f73248cb22e1b8f9cacf
Opcode Fuzzy Hash: 8635a13517db9147ca88e6c1994c1e63e85e115acab2f3846d9047911b568965
Instruction Fuzzy Hash: 5CD09E31658301AFEF098F20DD16F2EBAA2EB84B01F10962CBA82950E0D6755C159B26

Function 00405947 Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesA.KERNELBASE(?,?,0040555F,?,?,00000000,00405742,?,?,?,?), ref: 0040594C
SetFileAttributesA.KERNELBASE(?,00000000), ref: 00405960

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction ID: 96e5362f07f59601f7516fe8bcac2aa0a8151a45168581d09323fa3b8cc485cf
Opcode Fuzzy Hash: 123b2631ce2b274a689f6f42d71c67174a47df8962c272e460887a4e83ced065
Instruction Fuzzy Hash: F7D01272908121AFC2102738ED0C89BBF65EB543717058B35FDB9F22F0D7304C568AA6

Function 0040359F Relevance: 3.0, APIs: 1, Strings: 1, Instructions: 11COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,004033D6,?), ref: 004035AA

Strings

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\, xrefs: 004035BE

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\
API String ID: 2962429428-3719007917
Opcode ID: 596cad97df7a130adaf378ac47e28dabc4cf3a27c081830e49709f32aaba56d5
Instruction ID: f4b59f51dd056b556ace1dccfc0996fbca79989fe12c672f2328a55b3cb2227a
Opcode Fuzzy Hash: 596cad97df7a130adaf378ac47e28dabc4cf3a27c081830e49709f32aaba56d5
Instruction Fuzzy Hash: FBC08030504640B7D1247F79AD4B5193A145B40335FA04376F8B4F00F1C73C5B45555D

Function 00405455 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryA.KERNELBASE(?,00000000,004030CC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040545B
GetLastError.KERNEL32 ref: 00405469

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction ID: ace853db513f64caea17b5c73fb52fb3118c2a3fabff3065b7385b8b337d2f64
Opcode Fuzzy Hash: 5a69f4d8b5a7b583b3b8a13bd9b089cb74a3312a80339e25d7f83e3ab18a8421
Instruction Fuzzy Hash: 9DC08C30B18101EAC6100B30AE087073D50AB00742F1444356206E10E0C6309050CD2F

Function 00402283 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

WritePrivateProfileStringA.KERNEL32(00000000,00000000,?,00000000), ref: 004022BC

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
Instruction ID: ed5e863b5af70a22674a87f6432e4eb84017b1e79b4e81bbc09640d5f5368664
Opcode Fuzzy Hash: 4656573f168c310efd594f08e96abc660716981113b3fc3e41d9438b56e455a3
Instruction Fuzzy Hash: 8AE04F31B001746FDB217AF14E8EE7F11989B84348B64417EF601B62C3DDBC4D434AA9

Function 00405A13 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,00000020,?,0040305C,00000000,0040A8C0,00000020,0040A8C0,00000020,000000FF,00000004,00000000), ref: 00405A27

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction ID: edb1125888c6416cb1e0b95ca9609c2ac4c4c792cbd4e8f88826aa2405e91300
Opcode Fuzzy Hash: d04482319dc3028e4ce08f739f1cf32aeeec85f3b87b0f01a1fec36d148a5575
Instruction Fuzzy Hash: D7E0EC3261425EEFDF109E659C40AEB7B6DEB053A4F048532FD25E2150E271E8219FB5

Function 004059E4 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(00000000,00000000,00000004,00000004,00000000,000000FF,?,0040308E,00000000,00000000,00402EEB,000000FF,00000004,00000000,00000000,00000000), ref: 004059F8

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction ID: 6c2e581bc83b2d89c4a498056592e8f52b2bea012b9e1656670f40d352b29975
Opcode Fuzzy Hash: 9e9b74a17ccb5deaff559da35202fcfca8c983c6050daaa8761ff941af9ce947
Instruction Fuzzy Hash: 4DE0EC3272429AABDF109E559C44EEF7BACEB05360F048932FD15E3190D235ED219FA9

Function 00405BB4 Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MoveFileExA.KERNEL32(?,?,00000005(MOVEFILE_REPLACE_EXISTING|MOVEFILE_DELAY_UNTIL_REBOOT)), ref: 00405BBE

Part of subcall function 00405A42: lstrcpyA.KERNEL32(00421A98,NUL,?,00000000,?,00000000,00405BD5,?,?), ref: 00405A51
Part of subcall function 00405A42: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405BD5,?,?), ref: 00405A75
Part of subcall function 00405A42: GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405A7E
Part of subcall function 00405A42: GetShortPathNameA.KERNEL32(00421E98,00421E98,00000400), ref: 00405A9B
Part of subcall function 00405A42: wsprintfA.USER32 ref: 00405AB9
Part of subcall function 00405A42: GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405AF4
Part of subcall function 00405A42: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B03
Part of subcall function 00405A42: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3B
Part of subcall function 00405A42: SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405B91

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$NamePathShortlstrcpy$AllocCloseGlobalHandleMovePointerSizewsprintf
String ID:
API String ID: 2305538632-0
Opcode ID: 200995f69a62734c116fa759da9e398c1731b90633fe871f8e3bc0a5ec9d069e
Instruction ID: 84c318f3e4a96c22bc0b86da1b6d9270b2a2b8de3931848374d89fd7c22897fb
Opcode Fuzzy Hash: 200995f69a62734c116fa759da9e398c1731b90633fe871f8e3bc0a5ec9d069e
Instruction Fuzzy Hash: 0DD09E35208601AEDA115B50DD05A5B7BB5EB90355F10C52AF289504B0E73594519F09

Function 00403091 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,00402E2D,?), ref: 0040309F

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction ID: 49fdcfdf8b1973cd13611e97ba0bfafd8618b6cb304eeeee9131019f9f046fb0
Opcode Fuzzy Hash: 0070af3e33726fe8c9f5218e9eb5d27e4edbe1e9193197dd8736a9b9f47decae
Instruction Fuzzy Hash: 03B01271644200BFDA214F00DF05F057B21A790700F10C030B748380F082712420EB4D

Non-executed Functions

Function 0040488F Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 004048A7
GetDlgItem.USER32(?,00000408), ref: 004048B2
GlobalAlloc.KERNEL32(00000040,?), ref: 004048FC
LoadBitmapA.USER32(0000006E), ref: 0040490F
SetWindowLongA.USER32(?,000000FC,00404E86), ref: 00404928
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 0040493C
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 0040494E
SendMessageA.USER32(?,00001109,00000002), ref: 00404964
SendMessageA.USER32(?,0000111C,00000000,00000000), ref: 00404970
SendMessageA.USER32(?,0000111B,00000010,00000000), ref: 00404982
DeleteObject.GDI32(00000000), ref: 00404985
SendMessageA.USER32(?,00000143,00000000,00000000), ref: 004049B0
SendMessageA.USER32(?,00000151,00000000,00000000), ref: 004049BC
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A51
SendMessageA.USER32(?,0000110A,00000003,00000000), ref: 00404A7C
SendMessageA.USER32(?,00001100,00000000,?), ref: 00404A90
GetWindowLongA.USER32(?,000000F0), ref: 00404ABF
SetWindowLongA.USER32(?,000000F0,00000000), ref: 00404ACD
ShowWindow.USER32(?,00000005), ref: 00404ADE
SendMessageA.USER32(?,00000419,00000000,?), ref: 00404BDB
SendMessageA.USER32(?,00000147,00000000,00000000), ref: 00404C40
SendMessageA.USER32(?,00000150,00000000,00000000), ref: 00404C55
SendMessageA.USER32(?,00000420,00000000,00000020), ref: 00404C79
SendMessageA.USER32(?,00000200,00000000,00000000), ref: 00404C99
ImageList_Destroy.COMCTL32(?), ref: 00404CAE
GlobalFree.KERNEL32(?), ref: 00404CBE
SendMessageA.USER32(?,0000014E,00000000,00000000), ref: 00404D37
SendMessageA.USER32(?,00001102,?,?), ref: 00404DE0
SendMessageA.USER32(?,0000110D,00000000,00000008), ref: 00404DEF
InvalidateRect.USER32(?,00000000,00000001), ref: 00404E0F
ShowWindow.USER32(?,00000000), ref: 00404E5D
GetDlgItem.USER32(?,000003FE), ref: 00404E68
ShowWindow.USER32(00000000), ref: 00404E6F

Strings

M, xrefs: 00404A38
, xrefs: 00404E47
N, xrefs: 00404B19

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 8b0289ef19e9e7d4f6956f04046df2f7fedd754f5cc9c605ccbb11d5e9afe659
Instruction ID: e7c54df8ad39b376662a796d960b289492e5a6982c1727c2c37b81bede79f7f2
Opcode Fuzzy Hash: 8b0289ef19e9e7d4f6956f04046df2f7fedd754f5cc9c605ccbb11d5e9afe659
Instruction Fuzzy Hash: 43025EB0A00209AFEF109F54DC85AAE7BB5FB84315F10817AF611B62E1D7789E42DF58

Function 00405050 Relevance: 54.3, APIs: 36, Instructions: 282windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 004050AF
GetDlgItem.USER32(?,000003EE), ref: 004050BE
GetClientRect.USER32(?,?), ref: 004050FB
GetSystemMetrics.USER32(00000002), ref: 00405102
SendMessageA.USER32(?,0000101B,00000000,?), ref: 00405123
SendMessageA.USER32(?,00001036,00004000,00004000), ref: 00405134
SendMessageA.USER32(?,00001001,00000000,?), ref: 00405147
SendMessageA.USER32(?,00001026,00000000,?), ref: 00405155
SendMessageA.USER32(?,00001024,00000000,?), ref: 00405168
ShowWindow.USER32(00000000,?,0000001B,?), ref: 0040518A
ShowWindow.USER32(?,00000008), ref: 0040519E
GetDlgItem.USER32(?,000003EC), ref: 004051BF
SendMessageA.USER32(00000000,00000401,00000000,75300000), ref: 004051CF
SendMessageA.USER32(00000000,00000409,00000000,?), ref: 004051E8
SendMessageA.USER32(00000000,00002001,00000000,?), ref: 004051F4
GetDlgItem.USER32(?,000003F8), ref: 004050CD

Part of subcall function 00403F13: SendMessageA.USER32(00000028,?,00000001,00403D44), ref: 00403F21

GetDlgItem.USER32(?,000003EC), ref: 00405210
CreateThread.KERNEL32(00000000,00000000,Function_00004FE4,00000000), ref: 0040521E
CloseHandle.KERNEL32(00000000), ref: 00405225
ShowWindow.USER32(00000000), ref: 00405248
ShowWindow.USER32(?,00000008), ref: 0040524F
ShowWindow.USER32(00000008), ref: 00405295
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 004052C9
CreatePopupMenu.USER32 ref: 004052DA
AppendMenuA.USER32(00000000,00000000,00000001,00000000), ref: 004052EF
GetWindowRect.USER32(?,000000FF), ref: 0040530F
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 00405328
SendMessageA.USER32(?,0000102D,00000000,?), ref: 00405364
OpenClipboard.USER32(00000000), ref: 00405374
EmptyClipboard.USER32 ref: 0040537A
GlobalAlloc.KERNEL32(00000042,?), ref: 00405383
GlobalLock.KERNEL32(00000000), ref: 0040538D
SendMessageA.USER32(?,0000102D,00000000,?), ref: 004053A1
GlobalUnlock.KERNEL32(00000000), ref: 004053BA
SetClipboardData.USER32(00000001,00000000), ref: 004053C5
CloseClipboard.USER32 ref: 004053CB

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID:
API String ID: 590372296-0
Opcode ID: d6ecd7d14b8e00b748d1229dc10f545a94969e68e0fceeae392a714a00d68d17
Instruction ID: d5cc627e10ac9a037e5b70d1472d8d3a221fef050c439e23246209dc4a3cc6f1
Opcode Fuzzy Hash: d6ecd7d14b8e00b748d1229dc10f545a94969e68e0fceeae392a714a00d68d17
Instruction Fuzzy Hash: 53A159B1900208BFDB219FA0DD85AAE7F79FB48355F10407AFA01B61A0C7B55E41DF69

Function 0040431C Relevance: 19.5, APIs: 10, Strings: 1, Instructions: 274stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040436B
SetWindowTextA.USER32(00000000,?), ref: 00404395
SHBrowseForFolderA.SHELL32(?,0041F0E0,?), ref: 00404446
CoTaskMemFree.OLE32(00000000), ref: 00404451
lstrcmpiA.KERNEL32(004226A0,0041FD08), ref: 00404483
lstrcatA.KERNEL32(?,004226A0), ref: 0040448F
SetDlgItemTextA.USER32(?,000003FB,?), ref: 004044A1

Part of subcall function 004054D3: GetDlgItemTextA.USER32(?,?,00000400,004044D8), ref: 004054E6

Part of subcall function 00405F64: CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
Part of subcall function 00405F64: CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
Part of subcall function 00405F64: CharNextA.USER32(?,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
Part of subcall function 00405F64: CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE

GetDiskFreeSpaceA.KERNEL32(0041ECD8,?,?,0000040F,?,0041ECD8,0041ECD8,?,00000001,0041ECD8,?,?,000003FB,?), ref: 0040455F
MulDiv.KERNEL32(?,0000040F,00000400), ref: 0040457A

Part of subcall function 004046D3: lstrlenA.KERNEL32(0041FD08,0041FD08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,?), ref: 00404771
Part of subcall function 004046D3: wsprintfA.USER32 ref: 00404779
Part of subcall function 004046D3: SetDlgItemTextA.USER32(?,0041FD08), ref: 0040478C

Strings

A, xrefs: 0040443F

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: A
API String ID: 2624150263-3554254475
Opcode ID: 1558e11706ab6d26c01ec83b0c58713cad93a9e9ab837f02d5dc5529ec40a987
Instruction ID: 222947b4accbc62cc0073c5541b0f9589876626f1104fcc3d8441c992cea6716
Opcode Fuzzy Hash: 1558e11706ab6d26c01ec83b0c58713cad93a9e9ab837f02d5dc5529ec40a987
Instruction Fuzzy Hash: 71A17EB1900209ABDB11AFA5CC45BEFB6B8EF84315F14843BF711B62D1D77C8A418B69

Function 0040205E Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 139comCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(00407408,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 004020DD
MultiByteToWideChar.KERNEL32(?,?,?,000000FF,?,00000400,?,00000001,004073F8,?,?,00000045,000000CD,00000002,000000DF,000000F0), ref: 00402189

Strings

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 0040211D

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: ByteCharCreateInstanceMultiWide
String ID: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696
API String ID: 123533781-3053395492
Opcode ID: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
Instruction ID: 15b8319daa3a69dadbe16bc3493db081a7dc62ee607a685d27ecc12527328b4b
Opcode Fuzzy Hash: 98c6856de954bf32f67bc9aae575288044ef0a57168b27d926b9bae310f30c25
Instruction Fuzzy Hash: 785138B1A00208BFCF10DFA4C988A9D7BB5FF48319F20856AF515EB2D1DB799941CB54

Function 00402688 Relevance: 1.5, APIs: 1, Instructions: 29fileCOMMON

Download Yara Rule

APIs

FindFirstFileA.KERNEL32(00000000,?,00000002), ref: 00402697

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
Instruction ID: a95b2630499809d01a6e7b037cab792d100f7a465f9f887e4e98b5ff960ae470
Opcode Fuzzy Hash: a8d2051a0b43e45e0548476364d3f5ec7a3e7dc7c9238cb7b637b6be69fa9f30
Instruction Fuzzy Hash: 79F0A7726082009BE701E7A49949AEE7778DB61314F60057BE241A21C1D7B84985AB3A

Function 00403A0B Relevance: 48.3, APIs: 32, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403A47
ShowWindow.USER32(?), ref: 00403A64
DestroyWindow.USER32 ref: 00403A78
SetWindowLongA.USER32(?,00000000,00000000), ref: 00403A94
GetDlgItem.USER32(?,?), ref: 00403AB5
SendMessageA.USER32(00000000,000000F3,00000000,00000000), ref: 00403AC9
IsWindowEnabled.USER32(00000000), ref: 00403AD0
GetDlgItem.USER32(?,00000001), ref: 00403B7E
GetDlgItem.USER32(?,00000002), ref: 00403B88
SetClassLongA.USER32(?,000000F2,?), ref: 00403BA2
SendMessageA.USER32(0000040F,00000000,00000001,?), ref: 00403BF3
GetDlgItem.USER32(?,00000003), ref: 00403C99
ShowWindow.USER32(00000000,?), ref: 00403CBA
EnableWindow.USER32(?,?), ref: 00403CCC
EnableWindow.USER32(?,?), ref: 00403CE7
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 00403CFD
EnableMenuItem.USER32(00000000), ref: 00403D04
SendMessageA.USER32(?,000000F4,00000000,00000001), ref: 00403D1C
SendMessageA.USER32(?,00000401,00000002,00000000), ref: 00403D2F
lstrlenA.KERNEL32(0041FD08,?,0041FD08,00422F00), ref: 00403D58
SetWindowTextA.USER32(?,0041FD08), ref: 00403D67
ShowWindow.USER32(?,0000000A), ref: 00403E9B

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID:
API String ID: 184305955-0
Opcode ID: 3ac918ef0a42e48e667534ebe08b1c5e2c6f4e88b6f53ea8c8a8fe3e2e231469
Instruction ID: e8e4c14712e0ebd1bd3c96694815290efe84e81baa174b168cbdfcdac135d6c4
Opcode Fuzzy Hash: 3ac918ef0a42e48e667534ebe08b1c5e2c6f4e88b6f53ea8c8a8fe3e2e231469
Instruction Fuzzy Hash: 29C1DF71A04205BBDB20AF61EE45E2B3E7CFB45706B40453EF601B11E1C779A942AB6E

Function 00404027 Relevance: 38.7, APIs: 20, Strings: 2, Instructions: 205windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(00000000,-0000040A,00000001), ref: 004040B2
GetDlgItem.USER32(00000000,000003E8), ref: 004040C6
SendMessageA.USER32(00000000,0000045B,00000001,00000000), ref: 004040E4
GetSysColor.USER32(?), ref: 004040F5
SendMessageA.USER32(00000000,00000443,00000000,?), ref: 00404104
SendMessageA.USER32(00000000,00000445,00000000,04010000), ref: 00404113
lstrlenA.KERNEL32(?), ref: 00404116
SendMessageA.USER32(00000000,00000435,00000000,00000000), ref: 00404125
SendMessageA.USER32(00000000,00000449,?,00000110), ref: 0040413A
GetDlgItem.USER32(?,0000040A), ref: 0040419C
SendMessageA.USER32(00000000), ref: 0040419F
GetDlgItem.USER32(?,000003E8), ref: 004041CA
SendMessageA.USER32(00000000,0000044B,00000000,00000201), ref: 0040420A
LoadCursorA.USER32(00000000,00007F02), ref: 00404219
SetCursor.USER32(00000000), ref: 00404222
ShellExecuteA.SHELL32(0000070B,open,004226A0,00000000,00000000,00000001), ref: 00404235
LoadCursorA.USER32(00000000,00007F00), ref: 00404242
SetCursor.USER32(00000000), ref: 00404245
SendMessageA.USER32(00000111,00000001,00000000), ref: 00404271
SendMessageA.USER32(00000010,00000000,00000000), ref: 00404285

Strings

open, xrefs: 0040422D
N, xrefs: 004041B8

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$open
API String ID: 3615053054-904208323
Opcode ID: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
Instruction ID: f5dd8c80699fee66c1c508087d6ededbe7bbcdfb93c9c5870bdb982cd402330a
Opcode Fuzzy Hash: d6331d360d592cb1fcb1934a6ab791839a151b05b6f3426df7f2f496f579edd7
Instruction Fuzzy Hash: 1261C5B1A40209BFEB109F61DC45F6A7B79FB84741F10807AFB057A2D1C7B8A951CB98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcA.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectA.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextA.USER32(00000000,00422F00,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
Instruction ID: a0b7ce50fec83efafeb16569406a1c152c04985fcf8b97c7298fc3655e55bd79
Opcode Fuzzy Hash: c0f94b8c962ee7b75acafc3cefd778743504d8a107dd351fe724bfdc705f9f00
Instruction Fuzzy Hash: CD419B71804249AFCF058FA4CD459AFBFB9FF44310F00812AF961AA1A0C738EA50DFA5

Function 00405A42 Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyA.KERNEL32(00421A98,NUL,?,00000000,?,00000000,00405BD5,?,?), ref: 00405A51
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,00000000,00405BD5,?,?), ref: 00405A75
GetShortPathNameA.KERNEL32(?,00421A98,00000400), ref: 00405A7E

Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
Part of subcall function 004058D1: lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913

GetShortPathNameA.KERNEL32(00421E98,00421E98,00000400), ref: 00405A9B
wsprintfA.USER32 ref: 00405AB9
GetFileSize.KERNEL32(00000000,00000000,00421E98,C0000000,00000004,00421E98,?,?,?,?,?), ref: 00405AF4
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405B03
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405B3B
SetFilePointer.KERNEL32(004093B0,00000000,00000000,00000000,00000000,00421698,00000000,-0000000A,004093B0,00000000,[Rename],00000000,00000000,00000000), ref: 00405B91
GlobalFree.KERNEL32(00000000), ref: 00405BA2
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00405BA9

Part of subcall function 0040596C: GetFileAttributesA.KERNELBASE(00000003,00402CA6,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 00405970
Part of subcall function 0040596C: CreateFileA.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405992

Strings

[Rename], xrefs: 00405B23, 00405B35
%s=%s, xrefs: 00405AAF
NUL, xrefs: 00405A4B

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %s=%s$NUL$[Rename]
API String ID: 222337774-4148678300
Opcode ID: 4c27ce9d423c33f638fbced1664b30ba87b14f005f57ce999c1b8a6a2e252c84
Instruction ID: 42b7cc2c3f2f4ef7c3412fd2f3d3cbe4eee66c4c235e50fd6e5efd85f9217fc4
Opcode Fuzzy Hash: 4c27ce9d423c33f638fbced1664b30ba87b14f005f57ce999c1b8a6a2e252c84
Instruction Fuzzy Hash: 9931E271A04B19ABD2206B619C89F6B3A6CDF45755F14003AFE05F62D2DA7CBC008E6D

Function 00405F64 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,*?|<>/":,00000000,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FBC
CharNextA.USER32(?,?,?,00000000), ref: 00405FC9
CharNextA.USER32(?,"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" ,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FCE
CharPrevA.USER32(?,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000,004030B4,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405FDE

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405F65
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 00405FA0
*?|<>/":, xrefs: 00405FAC

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-1377249131
Opcode ID: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction ID: a0964663e3c08fb0288e5f4f4a0160773f2bbbf5a4d40b443b4f636863f092b1
Opcode Fuzzy Hash: ce3d7990729f771fdc32bb0ed1b54e2c2469674ae1568702cd8079844570f2a1
Instruction Fuzzy Hash: C611C451808F922EEB3216640C44BBB7F99CF5A760F18007BE9D4B22C2D67C5C429F6E

Function 00403F45 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongA.USER32(?,000000EB), ref: 00403F62
GetSysColor.USER32(00000000), ref: 00403F7E
SetTextColor.GDI32(?,00000000), ref: 00403F8A
SetBkMode.GDI32(?,?), ref: 00403F96
GetSysColor.USER32(?), ref: 00403FA9
SetBkColor.GDI32(?,?), ref: 00403FB9
DeleteObject.GDI32(?), ref: 00403FD3
CreateBrushIndirect.GDI32(?), ref: 00403FDD

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction ID: 563dd17f99c902cd34f005863f03740a6a5938172a6e5e033378c94734032825
Opcode Fuzzy Hash: e8c91e704ef8b2f1a11ad189bfd14f771d09f9d58710722270f9777396a44b4e
Instruction Fuzzy Hash: B4214271908705ABC7219F68DD48F4BBFF8AF01715B048A29E895E26E0D735EA04CB55

Function 00404F12 Relevance: 10.6, APIs: 7, Instructions: 73stringwindowCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000,?), ref: 00404F4B
lstrlenA.KERNEL32(00402FCF,0041F4E8,00000000,0040E8C0,00000000,?,?,?,?,?,?,?,?,?,00402FCF,00000000), ref: 00404F5B
lstrcatA.KERNEL32(0041F4E8,00402FCF,00402FCF,0041F4E8,00000000,0040E8C0,00000000), ref: 00404F6E
SetWindowTextA.USER32(0041F4E8,0041F4E8), ref: 00404F80
SendMessageA.USER32(?,00001004,00000000,00000000), ref: 00404FA6
SendMessageA.USER32(?,00001007,00000000,00000001), ref: 00404FC0
SendMessageA.USER32(?,00001013,?,00000000), ref: 00404FCE

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: 558402415f57fe0eb81db75807d2d057a66030d2c136bde9c432be6294094776
Instruction ID: 5a9a404093729f8c7a4ed64dcb73daf90ff889549f225b9df3951733f5861a8d
Opcode Fuzzy Hash: 558402415f57fe0eb81db75807d2d057a66030d2c136bde9c432be6294094776
Instruction Fuzzy Hash: EB219DB1A00119BADF119FA5DD84ADEBFB9EF44354F14807AF904B6290C7788E41DBA8

Function 004047DD Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageA.USER32(?,0000110A,00000009,00000000), ref: 004047F8
GetMessagePos.USER32 ref: 00404800
ScreenToClient.USER32(?,?), ref: 0040481A
SendMessageA.USER32(?,00001111,00000000,?), ref: 0040482C
SendMessageA.USER32(?,0000110C,00000000,?), ref: 00404852

Strings

f, xrefs: 0040482E

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction ID: 206dc1e0429e6aa6b627cd25208fa2295557d59b2a7717453fa0c9894da25502
Opcode Fuzzy Hash: 13dcb630cae817d26763a7c5c34c1a537cec2b83c976c16d0abeb4614e4307e4
Instruction Fuzzy Hash: E6015276D00259BADB01DB94DC45FFEBBBCAF55711F10412BBA10B61C0C7B4A501CBA5

Function 00402B7F Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 40timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402B9A
MulDiv.KERNEL32(044A887E,00000064,044AB7B8), ref: 00402BC5
wsprintfA.USER32 ref: 00402BD5
SetWindowTextA.USER32(?,?), ref: 00402BE5
SetDlgItemTextA.USER32(?,00000406,?), ref: 00402BF7

Strings

verifying installer: %d%%, xrefs: 00402BCF

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: verifying installer: %d%%
API String ID: 1451636040-82062127
Opcode ID: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
Instruction ID: bd73235a5a2a729140de961e31d76a0e47d27260d0eaef7d75f80e35c4c54abd
Opcode Fuzzy Hash: 649971ee7512e9da800057b1e5ac373431693e3f4f1e876899c067cd5a0faa84
Instruction Fuzzy Hash: EF01F471540208BBEF109F60DD49EEE3B79EB04305F008039FA16B51D1D7B59955DF59

Function 004026C6 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 0040271A
GlobalAlloc.KERNEL32(00000040,?,00000000,?,?,?,?,?,000000F0), ref: 00402736
GlobalFree.KERNEL32(?), ref: 0040276F
GlobalFree.KERNEL32(00000000), ref: 00402782
CloseHandle.KERNEL32(?,?,?,?,000000F0), ref: 0040279A
DeleteFileA.KERNEL32(?,00000000,40000000,00000002,00000000,00000000,?,?,?,000000F0), ref: 004027AE

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 39fbd17f46fc9c371fd9deabdbb1a4d81bf886de883c9339f90e348bb50c0e41
Instruction ID: 55e8cf3ffad71cabca96213aa966ad8f6b0c6824c0bc9dabfeb9c0d6c9f08848
Opcode Fuzzy Hash: 39fbd17f46fc9c371fd9deabdbb1a4d81bf886de883c9339f90e348bb50c0e41
Instruction Fuzzy Hash: 03217C71800124BBCF216FA5DE89EAE7A79EF09324F14023AF950762D1C7795D418FA9

Function 00402A7A Relevance: 7.6, APIs: 5, Instructions: 67registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExA.ADVAPI32(?,?,00000000,?,?), ref: 00402A9B
RegEnumKeyA.ADVAPI32(?,00000000,?,00000105), ref: 00402AD7
RegCloseKey.ADVAPI32(?), ref: 00402AE0
RegCloseKey.ADVAPI32(?), ref: 00402B05
RegDeleteKeyA.ADVAPI32(?,?), ref: 00402B23

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 26d703e6b955c0b1753e13e50ef068aceb5afa025d50a3e8e2eadb28cc0acf60
Instruction ID: feb6aed171ad8b85e204e5b4e2feb4536d295dbd67c3687bd8867431d3a466b7
Opcode Fuzzy Hash: 26d703e6b955c0b1753e13e50ef068aceb5afa025d50a3e8e2eadb28cc0acf60
Instruction Fuzzy Hash: 53117F71A00108FFDF229F90DE89EAE3B7DEB54349B104076FA01B10A0D7749E51DB69

Function 00401CDE Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?), ref: 00401CE2
GetClientRect.USER32(00000000,?), ref: 00401CEF
LoadImageA.USER32(?,00000000,?,?,?,?), ref: 00401D10
SendMessageA.USER32(00000000,00000172,?,00000000), ref: 00401D1E
DeleteObject.GDI32(00000000), ref: 00401D2D

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
Instruction ID: 14b9f5ff68e8b0ed0f2204d74c17d06140583eb6ed2bbf798243b331d3a4cd3b
Opcode Fuzzy Hash: 17232caade98c5884c3b98c25dda3274542a73d841a3bd6b31c87e9b59191b88
Instruction Fuzzy Hash: A9F0E7B2A04114AFEB01ABE4DE88DAFB7BDEB54305B10447AF602F6191C7789D018B79

Function 00401D38 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D3B
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D48
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D57
ReleaseDC.USER32(?,00000000), ref: 00401D68
CreateFontIndirectA.GDI32(0040A7F0), ref: 00401DB3

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 54d11e4959632539d7c5822479490e62378c8afe9ef9106c9a33de1f24eaef6b
Instruction ID: 818c9bdddfe1b1fffd76dbb1b88acba4993fd419864b94457e62d7fc32e1ff32
Opcode Fuzzy Hash: 54d11e4959632539d7c5822479490e62378c8afe9ef9106c9a33de1f24eaef6b
Instruction Fuzzy Hash: FE016232948740AFE7416B70AE1AFAA3FB4A755305F108479F201B72E3C67811569B3F

Function 004046D3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(0041FD08,0041FD08,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,004045EE,000000DF,00000000,00000400,?), ref: 00404771
wsprintfA.USER32 ref: 00404779
SetDlgItemTextA.USER32(?,0041FD08), ref: 0040478C

Strings

%u.%u%s%s, xrefs: 0040475B

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s
API String ID: 3540041739-3551169577
Opcode ID: bbe280539c3cc3020c43bf789c637de2f8d0099704e891219e4d784778b6cf22
Instruction ID: 079308417c3a62341de1df324b483ce4e469374b9790fc4fe8de96a48b85a08e
Opcode Fuzzy Hash: bbe280539c3cc3020c43bf789c637de2f8d0099704e891219e4d784778b6cf22
Instruction Fuzzy Hash: F011A573A0412837EB0065699C45EAF3298DB86374F254637FA25F71D2EA788C5245A8

Function 0040576B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 00405771
CharPrevA.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004030C6,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004032C9), ref: 0040577A
lstrcatA.KERNEL32(?,00409014), ref: 0040578B

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 0040576B

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction ID: 00e6a1abdfef3fccf4d12e3b382aa79108487555f8088e95eeaee7bf5793dfbe
Opcode Fuzzy Hash: 39623dee3265ed167cf4eb0d952b1efefe5673d98ca6e2622bb109ae9f6b3ea7
Instruction Fuzzy Hash: 94D0A9B2A05A307AD3122715AC0DE8B2A08CF82300B094023F200B72A2CB3C1D418BFE

Function 00402364 Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExA.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023A2
lstrlenA.KERNEL32(00409BE8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023C2
RegSetValueExA.ADVAPI32(?,?,?,?,00409BE8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023FB
RegCloseKey.ADVAPI32(?,?,?,00409BE8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024D8

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
Instruction ID: 26fcae0a7b2a502e926faea7c6e927eea7b3aae3134fdb689c9e3a18d41500d2
Opcode Fuzzy Hash: 1dca66d2d1093a5130de9b07e79a19b0c80f7b3ba9a11136c7381f0e18dd9290
Instruction Fuzzy Hash: 3E1145B1E00108BFEB10AFA5EE89EAF767DEB54358F10403AF505B71D1D6B85D419B28

Function 00405804 Relevance: 6.0, APIs: 3, Strings: 1, Instructions: 41COMMON

Download Yara Rule

APIs

CharNextA.USER32(?,?,C:\,?,00405870,C:\,C:\,74DF3410,?,C:\Users\user\AppData\Local\Temp\,004055BB,?,74DF3410,C:\Users\user\AppData\Local\Temp\,00000000), ref: 00405812
CharNextA.USER32(00000000), ref: 00405817
CharNextA.USER32(00000000), ref: 0040582B

Strings

C:\, xrefs: 00405805

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction ID: 4ca260c7e1a22d06af12069221c3406c2bee361732d71c1e98a9e22686a99acb
Opcode Fuzzy Hash: b52e97735ebcacdda31b679af32a6ceda5c9d10ed76b2852ac30fc4ce6ba53e1
Instruction Fuzzy Hash: 71F0C253908F942BFB3276641C44B675F88DB55350F04C07BEA80B62C2C6788860CBEA

Function 00402C02 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000,00000000,00402DE2,00000001), ref: 00402C15
GetTickCount.KERNEL32 ref: 00402C33
CreateDialogParamA.USER32(0000006F,00000000,00402B7F,00000000), ref: 00402C50
ShowWindow.USER32(00000000,00000005), ref: 00402C5E

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Window$CountCreateDestroyDialogParamShowTick
String ID:
API String ID: 2102729457-0
Opcode ID: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
Instruction ID: 69bd14cd8f1a0d496662edafeb8c2727d8675a530a128bc1770b64b88ff4c26b
Opcode Fuzzy Hash: bb4189f2555980a5a403f1716edff6096ea92162ad211e01232e213a33bdd725
Instruction Fuzzy Hash: 2CF05E7090A220ABD6217F64FE0CDDF7BA4FB41B527018576F144B21E4C379988ACB9D

Function 0040393E Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextA.USER32(00000000,00422F00), ref: 004039D6

Strings

1033, xrefs: 00403942, 0040394C, 004039BD
"C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" , xrefs: 0040393F

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe" $1033
API String ID: 530164218-797414705
Opcode ID: 486f1793fc8ee117fab60480f2aa26aac85a5ca9132015367b3694c6ae5d67fc
Instruction ID: 79edc1b1becbb318b5d11430581b7fe373163fbdb48c995140def98ab9010f1e
Opcode Fuzzy Hash: 486f1793fc8ee117fab60480f2aa26aac85a5ca9132015367b3694c6ae5d67fc
Instruction Fuzzy Hash: B311F3F1B04611ABCB20DF14DD809737BADEBC4756328823FE941A73A0C67D9D029B98

Function 00404E86 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00404EB5
CallWindowProcA.USER32(?,?,?,?), ref: 00404F06

Part of subcall function 00403F2A: SendMessageA.USER32(00000000,00000000,00000000,00000000), ref: 00403F3C

Strings

, xrefs: 00404E96

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
Instruction ID: f49a9e3fcece2dd6490d1841f3d0f5b5163df4d3f93a23d44cf999a9bd086e10
Opcode Fuzzy Hash: d7dba211b113031370aa0d375adf93c2d3682e4ecf800ebd227cab9ba7078c69
Instruction Fuzzy Hash: D10171B110020EABDF209F11DC84A9B3725FBC4754F208037FB11761D1DB799C61A7A9

Function 004035E4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,74DF3410,00000000,C:\Users\user\AppData\Local\Temp\,004035BC,004033D6,?), ref: 004035FE
GlobalFree.KERNEL32(00000000), ref: 00403605

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004035E4

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 1100898210-3081826266
Opcode ID: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
Instruction ID: f6c6d059f9b75f5cc6a79e0049e3afa1176d7e4558308c53008dbe788c85df41
Opcode Fuzzy Hash: a52acb0b260d536fd7618f3e20de318eec4c6c539c6bb2def64801f0e67eaa78
Instruction Fuzzy Hash: 3EE0C2338100206BC7211F0AED04B5E77AC6F48B22F054066FC407B3A08B742C418BCC

Function 004057B2 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp,00402CD2,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 004057B8
CharPrevA.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp,00402CD2,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,C:\Users\user\AppData\Local\Temp\TeamViewer_Setup_x64.exe,80000000,00000003), ref: 004057C6

Strings

C:\Users\user\AppData\Local\Temp, xrefs: 004057B2

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp
API String ID: 2709904686-47812868
Opcode ID: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction ID: 15550f116ff3ce815c4487a542d9ae56249738f0e4d38f85a76656e2d55d0e49
Opcode Fuzzy Hash: cad1fee570528055bb4f840757e41c2b2d093a40416f1971c342fc3ba500c074
Instruction Fuzzy Hash: FAD0C7B2409D705EF31353149C08B9F6A58DF16700F195463E141EB591C6785D415BBD

Function 004058D1 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 004058E1
lstrcmpiA.KERNEL32(00000000,00000000), ref: 004058F9
CharNextA.USER32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 0040590A
lstrlenA.KERNEL32(00000000,?,00000000,00405B2E,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405913

Memory Dump Source

Source File: 00000005.00000002.2467218415.0000000000401000.00000020.00000001.01000000.00000009.sdmp, Offset: 00400000, based on PE: true

Associated: 00000005.00000002.2467187175.0000000000400000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467277219.0000000000407000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000409000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000421000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000427000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.0000000000429000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467300427.000000000042D000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000005.00000002.2467432688.000000000042F000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_5_2_400000_TeamViewer_Setup_x64.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction ID: 481a9c588bbd1c68550dea5b76d7ebd72626077616c8f786d6c844a28ee3c139
Opcode Fuzzy Hash: d250403eeccc32afa1460bd507a63d74f6ad2c43926490d4129708a4008c1f50
Instruction Fuzzy Hash: 9EF0F632504418FFCB02AFA5DC0099EBBA8EF46360B2540B9F800F7310D274EF01ABA9

Analysis Process: TeamViewer_.exePID: 7820, Parent PID: 7772COMMON

Execution Graph

Execution Coverage:	25.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1341
Total number of Limit Nodes:	42

Executed Functions

Function 004033B6 Relevance: 91.4, APIs: 34, Strings: 18, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033D9
GetVersion.KERNEL32 ref: 004033DF
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403408
#17.COMCTL32(00000007,00000009), ref: 0040342B
OleInitialize.OLE32(00000000), ref: 00403432
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 0040344E
GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 00403463
GetModuleHandleW.KERNEL32(00000000,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00000000), ref: 00403476
CharNextW.USER32(00000000,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00000020), ref: 0040349D

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

GetTempPathW.KERNEL32(00000400,C:\Users\user\AppData\Local\Temp\), ref: 004035D7
GetWindowsDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,000003FB), ref: 004035E8
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,\Temp), ref: 004035F4
GetTempPathW.KERNEL32(000003FC,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,\Temp), ref: 00403608
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,Low), ref: 00403610
SetEnvironmentVariableW.KERNEL32(TEMP,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,Low), ref: 00403621
SetEnvironmentVariableW.KERNEL32(TMP,C:\Users\user\AppData\Local\Temp\), ref: 00403629
DeleteFileW.KERNELBASE(1033), ref: 0040363D

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

ExitProcess.KERNEL32(?), ref: 00403703
CoUninitialize.COMBASE(?), ref: 00403708
ExitProcess.KERNEL32 ref: 00403729
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00000000,?), ref: 0040373C
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,0040A328,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00000000,?), ref: 0040374B
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00000000,?), ref: 00403756
lstrcmpiW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\,.tmp,C:\Users\user\AppData\Local\Temp\,~nsu,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00000000,?), ref: 00403762
SetCurrentDirectoryW.KERNEL32(C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\), ref: 0040377E
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 004037D8
CopyFileW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,00420EE8,00000001), ref: 004037EC
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 00403819
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403848
OpenProcessToken.ADVAPI32(00000000), ref: 0040384F
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403864
AdjustTokenPrivileges.ADVAPI32 ref: 00403887
ExitWindowsEx.USER32(00000002,80040002), ref: 004038AC
ExitProcess.KERNEL32 ref: 004038CF

Strings

TEMP, xrefs: 0040361C
TMP, xrefs: 00403624
\Temp, xrefs: 004035EE
NSIS Error, xrefs: 00403454
C:\Users\user\AppData\Local\Temp\, xrefs: 004035CC, 004035D1, 004035E7, 004035F3, 00403602, 0040360F, 0040361B, 00403623, 00403739, 0040374A, 00403755, 00403761, 0040376E, 0040377D, 0040382E
Error launching installer, xrefs: 004036BF
Low, xrefs: 0040360A
~nsu, xrefs: 00403734
UXTHEME, xrefs: 004033FC, 00403401, 00403407
C:\Program Files\TeamViewer\TVExtractTemp, xrefs: 004036E5
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CD
C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe, xrefs: 004037E7
C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 0040375B, 00403760, 0040378D
C:\Program Files\TeamViewer, xrefs: 004035BA, 004036DA, 00403784, 0040378E
"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" , xrefs: 00403469, 0040346F, 00403665
.tmp, xrefs: 00403750
SeShutdownPrivilege, xrefs: 0040385E
1033, xrefs: 00403638

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Handle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" $.tmp$1033$C:\Program Files\TeamViewer$C:\Program Files\TeamViewer\TVExtractTemp$C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696$C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 354199918-1024944671
Opcode ID: e8a7877e60441a61d01466cbee3218a59cd968db92503058061a8fd593dce739
Instruction ID: be8551fa6605ebbbfda7487142ffb020be8bd547a3943651712312bea09c5587
Opcode Fuzzy Hash: e8a7877e60441a61d01466cbee3218a59cd968db92503058061a8fd593dce739
Instruction Fuzzy Hash: AED10571200300ABE7207F659D49A2B3AEDEB4074AF50443FF881B62D2DB7C8956876E

Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,74DF2EE0,00000000), ref: 00405998
lstrcatW.KERNEL32(C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\*.*,\*.*,C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 004059E0
lstrcatW.KERNEL32(?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A03
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A09
FindFirstFileW.KERNELBASE(C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\*.*,?,?,?,0040A014,?,C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A19
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB9
FindClose.KERNEL32(00000000), ref: 00405AC8

Strings

"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" , xrefs: 0040596F
\*.*, xrefs: 004059DA
C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\*.*, xrefs: 004059C8, 004059CE, 004059DF, 00405A18

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\*.*$\*.*
API String ID: 2035342205-1661485026
Opcode ID: 3e74ea5c1780804c8595fdd51fd85a972d4f395f22791088baa2fc53644d391a
Instruction ID: 6c547db7f4d1248ed83a6ec2b2b7cf99957869ea0eb35c9edb1a86952611c1c3
Opcode Fuzzy Hash: 3e74ea5c1780804c8595fdd51fd85a972d4f395f22791088baa2fc53644d391a
Instruction Fuzzy Hash: 5A41B530A40914A6CB21AB659CC9AAF7678EF41724F20427FF801711D1D77C5986DE6E

Function 004064C1 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,00426778,C:\,00405C83,C:\,C:\,00000000,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 004064CC
FindClose.KERNEL32(00000000), ref: 004064D8

Strings

C:\, xrefs: 004064C1
xgB, xrefs: 004064C2

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: C:\$xgB
API String ID: 2295610775-2001824454
Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction ID: 909a2899cbbcfc21b24ab628f9350e7a3c7b3772aa6d432f74911df6ac2d0bb5
Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction Fuzzy Hash: 8BD0C9315045209BC2111778AE4C85B7A98AF553317628A36B466F12A0C674CC22869C

Function 00406846 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction ID: 84f5b91c3f937eb173619b21672ae23043901769df73ed9f159891f0fc81c8d0
Opcode Fuzzy Hash: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction Fuzzy Hash: 72F18671D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7385A8ACF45

Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284
windowclipboardmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetDlgItem.USER32(?,00000403), ref: 0040547A
GetDlgItem.USER32(?,000003EE), ref: 00405489
GetClientRect.USER32(?,?), ref: 004054C6
GetSystemMetrics.USER32(00000002), ref: 004054CD
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054EE
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054FF
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405512
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405520
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405533
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405555
ShowWindow.USER32(?,00000008), ref: 00405569
GetDlgItem.USER32(?,000003EC), ref: 0040558A
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559A
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B3
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055BF
GetDlgItem.USER32(?,000003F8), ref: 00405498

Part of subcall function 00404277: SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

GetDlgItem.USER32(?,000003EC), ref: 004055DC
CreateThread.KERNELBASE(00000000,00000000,Function_000053B0,00000000), ref: 004055EA
CloseHandle.KERNEL32(00000000), ref: 004055F1
ShowWindow.USER32(00000000), ref: 00405615
ShowWindow.USER32(?,00000008), ref: 0040561A
ShowWindow.USER32(00000008), ref: 00405664
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405698
CreatePopupMenu.USER32 ref: 004056A9
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056BD
GetWindowRect.USER32(?,?), ref: 004056DD
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040572E
OpenClipboard.USER32(00000000), ref: 0040573E
EmptyClipboard.USER32 ref: 00405744
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405750
GlobalLock.KERNEL32(00000000), ref: 0040575A
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040576E
GlobalUnlock.KERNEL32(00000000), ref: 0040578E
SetClipboardData.USER32(0000000D,00000000), ref: 00405799
CloseClipboard.USER32 ref: 0040579F

Strings

{, xrefs: 00405682
(7B, xrefs: 0040570A

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 3356856100fded7762ccce4ebf21ef6244253d3db3b1b0b4e2cb175bf3461c6d
Instruction ID: 3349dadf3efb3a8fdffdb79f187be012afacb07b5928e089a4a7fd9dccbac2fd
Opcode Fuzzy Hash: 3356856100fded7762ccce4ebf21ef6244253d3db3b1b0b4e2cb175bf3461c6d
Instruction Fuzzy Hash: 60B15670900608FFDB119FA0DD89EAE3B79FB48354F40847AFA45A61A0CB754E52DF68

Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345
windowstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DA6
ShowWindow.USER32(?), ref: 00403DC3
DestroyWindow.USER32 ref: 00403DD7
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DF3
GetDlgItem.USER32(?,?), ref: 00403E14
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E28
IsWindowEnabled.USER32(00000000), ref: 00403E2F
GetDlgItem.USER32(?,00000001), ref: 00403EDD
GetDlgItem.USER32(?,00000002), ref: 00403EE7
SetClassLongW.USER32(?,000000F2,?), ref: 00403F01
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F52
GetDlgItem.USER32(?,00000003), ref: 00403FF8
ShowWindow.USER32(00000000,?), ref: 00404019
KiUserCallbackDispatcher.NTDLL(?,?), ref: 0040402B
EnableWindow.USER32(?,?), ref: 00404046
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040405C
EnableMenuItem.USER32(00000000), ref: 00404063
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040407B
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040408E
lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 004040B7
SetWindowTextW.USER32(?,00423728), ref: 004040CB
ShowWindow.USER32(?,0000000A), ref: 004041FF

Strings

(7B, xrefs: 004040A3

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Window$Item$MessageSend$Show$EnableLongMenu$CallbackClassDestroyDispatcherEnabledSystemTextUserlstrlen
String ID: (7B
API String ID: 3282139019-3251261122
Opcode ID: f1306570f035e21c4f068449413519e45d51919a909de34d05465df8e21c2881
Instruction ID: 4530f9416eb169af0d44378ddba5762a1eee688012323a74912104aead4a3b33
Opcode Fuzzy Hash: f1306570f035e21c4f068449413519e45d51919a909de34d05465df8e21c2881
Instruction Fuzzy Hash: A5C1FFB1640200FFCB206F61EE84E2B3AA8EB95745F40057EF641B21F1CB7999529B6D

Function 004039C7 Relevance: 47.5, APIs: 13, Strings: 14, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

lstrcatW.KERNEL32(1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00000000), ref: 00403A48
lstrlenW.KERNEL32(Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files\TeamViewer,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74DF3420), ref: 00403AC8
lstrcmpiW.KERNEL32(?,.exe,Remove folder: ,?,?,?,Remove folder: ,00000000,C:\Program Files\TeamViewer,1033,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403ADB
GetFileAttributesW.KERNEL32(Remove folder: ), ref: 00403AE6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files\TeamViewer), ref: 00403B2F

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

RegisterClassW.USER32(004291E0), ref: 00403B6C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B84
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403BB9
ShowWindow.USER32(00000005,00000000), ref: 00403BEF
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403C1B
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403C28
RegisterClassW.USER32(004291E0), ref: 00403C31
DialogBoxParamW.USER32(?,00000000,00403D6A,00000000), ref: 00403C50

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 004039CC
.DEFAULT\Control Panel\International, xrefs: 00403A33
RichEd20, xrefs: 00403BF5
RichEd32, xrefs: 00403C03
RichEdit20W, xrefs: 00403C13, 00403C19
C:\Program Files\TeamViewer, xrefs: 00403A57, 00403A5F, 00403B02, 00403B08, 00403B18
Remove folder: , xrefs: 00403A8F, 00403A98, 00403AA6, 00403AF5, 00403AFB
"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" , xrefs: 004039CB
RichEdit, xrefs: 00403C22
(7B, xrefs: 004039F3
.exe, xrefs: 00403AD5
Control Panel\Desktop\ResourceLocale, xrefs: 004039FB
_Nb, xrefs: 00403B4B, 00403BB3
1033, xrefs: 004039E7, 00403A43

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" $(7B$.DEFAULT\Control Panel\International$.exe$1033$C:\Program Files\TeamViewer$C:\Users\user\AppData\Local\Temp\$Control Panel\Desktop\ResourceLocale$Remove folder: $RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-63727898
Opcode ID: e4b79f2775376875fb57570f8962d2b7733680286c700de63aaa8ea03b262410
Instruction ID: e7f44595d902892b35b801f2f0c3734befc0b18a393fec54347386a87508d522
Opcode Fuzzy Hash: e4b79f2775376875fb57570f8962d2b7733680286c700de63aaa8ea03b262410
Instruction Fuzzy Hash: 8661C570244200BAD730AF669D49E2B3A7CEB84B49F40453FF981B62E2DB7D5912C63D

Function 00402E41 Relevance: 26.5, APIs: 5, Strings: 10, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402E55
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,00000400), ref: 00402E71

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,80000000,00000003), ref: 00402EBA
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403001

Strings

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 00402E9C, 00402EA1, 00402EA7
Null, xrefs: 00402F3A
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098
C:\Users\user\AppData\Local\Temp\, xrefs: 00402E4B, 00403019
Error launching installer, xrefs: 00402E91
Inst, xrefs: 00402F28
"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" , xrefs: 00402E41
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B
soft, xrefs: 00402F31

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696$C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$soft
API String ID: 2803837635-1373894812
Opcode ID: a88f7b64cf2f84ce6159e852375487555ed60e3ec4e5ecaf9a54fe269baa00ef
Instruction ID: e866f1dd798e5fb15c0a347603bcfded6ce2f229c2e481af73dd86df93422dd6
Opcode Fuzzy Hash: a88f7b64cf2f84ce6159e852375487555ed60e3ec4e5ecaf9a54fe269baa00ef
Instruction Fuzzy Hash: 9761C431A00215ABDB209F75DD49B9E7BB8EB00359F20817FF500F62D1DABD9A448B5D

Function 004061A0 Relevance: 21.2, APIs: 8, Strings: 4, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,?,00405314,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000), ref: 00406263
GetSystemDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004062E1
GetWindowsDirectoryW.KERNEL32(Remove folder: ,00000400), ref: 004062F4
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406330
SHGetPathFromIDListW.SHELL32(?,Remove folder: ), ref: 0040633E
CoTaskMemFree.OLE32(?), ref: 00406349
lstrcatW.KERNEL32(Remove folder: ,\Microsoft\Internet Explorer\Quick Launch), ref: 0040636D
lstrlenW.KERNEL32(Remove folder: ,00000000,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,?,00405314,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000), ref: 004063C7

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 004062AF
Remove folder: , xrefs: 004061CA, 004062AA, 004062CB, 004062E0, 004062F3, 0040630F, 0040633A, 0040636C, 00406372, 0040638C, 004063A0, 004063C0, 004063C6, 004063D2, 00406405
\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406367
Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\, xrefs: 004061C5

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Remove folder: $Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\$Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-4267009041
Opcode ID: ad7f9d25d5d15659371a18125183daf3d831ef86bf1ddb5fded95f80f67ed536
Instruction ID: 57c77dc533264c97ace6329bd87f7d674c2bea75a5b3d90d15d675b8bae5a73d
Opcode Fuzzy Hash: ad7f9d25d5d15659371a18125183daf3d831ef86bf1ddb5fded95f80f67ed536
Instruction Fuzzy Hash: 1E611571A00104EBDF209F24CC40AAE37A5AF15314F56817FED56BA2D0D73D8AA2CB9D

Function 004052DD Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 72
stringwindowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000), ref: 00405338
SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\), ref: 0040534A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Strings

Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\, xrefs: 004052FE, 0040530E, 00405314, 00405337, 00405343

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID: Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\
API String ID: 2531174081-3972654678
Opcode ID: 972aac7018336843b0c890e7bd87d5dddbcc3b404b63b40d4461520666951a00
Instruction ID: d14990956ab1253184f877e9e8298894284f42a30aea32824f5004b5108fa95f
Opcode Fuzzy Hash: 972aac7018336843b0c890e7bd87d5dddbcc3b404b63b40d4461520666951a00
Instruction Fuzzy Hash: 62217F71900518BACF119FA6DD44ACFBFB8EF85354F10807AF904B62A1C7B94A51DFA8

Function 00401767 Relevance: 12.4, APIs: 5, Strings: 2, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,C:\Program Files\TeamViewer\TVExtractTemp,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,00000000,00000000,InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!,C:\Program Files\TeamViewer\TVExtractTemp,?,?,00000031), ref: 004017CD

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Strings

InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!, xrefs: 00401785, 0040178E, 0040179B, 004017AD, 004017B9, 004017EF, 00401805, 00401823, 0040185F, 004018E0, 004018E9, 004018F3, 004018FE
C:\Program Files\TeamViewer\TVExtractTemp, xrefs: 00401796

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID: C:\Program Files\TeamViewer\TVExtractTemp$InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!
API String ID: 1941528284-2970256656
Opcode ID: 1862fb3b77c31d46c0470bd97efe8d86f4df64904e2d1f4c121f71988b6a393e
Instruction ID: b64174440326d41e90dd14f1ad6608c73badddfa8ee8632f400ec40acf256ac3
Opcode Fuzzy Hash: 1862fb3b77c31d46c0470bd97efe8d86f4df64904e2d1f4c121f71988b6a393e
Instruction Fuzzy Hash: 0C41C431900515BACF117FB5CC46DAE3679EF05329B20827BF422F51E2DA3C86629A6D

Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
GetTickCount.KERNEL32 ref: 00402DD8
wsprintfW.USER32 ref: 00402E06

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402E2A
ShowWindow.USER32(00000000,00000005), ref: 00402E38

Part of subcall function 00402D83: MulDiv.KERNEL32(00056D1C,00000064,0005863F), ref: 00402D98

Strings

... %d%%, xrefs: 00402E00

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: fea16c4b337e24937a113fc6e035eb6b9d553e5e7cb87782fe297e9c5fc018cb
Instruction ID: 67f39cb704aca6262626a7976268bb3bb8a333bdab68892006d91dd8afb4411f
Opcode Fuzzy Hash: fea16c4b337e24937a113fc6e035eb6b9d553e5e7cb87782fe297e9c5fc018cb
Instruction Fuzzy Hash: 96016D70541614EBC721AB60EF4DA9B7A68AF00706B14417FF885F12E0CBF85865CBEE

Function 004057AC Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 39
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF
GetLastError.KERNEL32 ref: 00405803
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405818
GetLastError.KERNEL32 ref: 00405822

Strings

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 004057AC
C:\Users\user\AppData\Local\Temp\, xrefs: 004057D2

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696
API String ID: 3449924974-4121872026
Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction ID: b278f7ea68de5888e34302da86fdb06c438f4ef9b03e74a9ab654546e4f81ce2
Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction Fuzzy Hash: 89010871D00619DADF10DBA0D9447EFBFB8EB04304F00803ADA44B6190E7789618DFA9

Function 004064E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
wsprintfW.USER32 ref: 0040653A
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040654E

Strings

%s%S.dll, xrefs: 00406534
\, xrefs: 00406510
UXTHEME, xrefs: 004064F1

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction ID: c6b4a3c42f63eea3762d57d51081eb848d485012b63e63803453d9912f42ff06
Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction Fuzzy Hash: 3AF0FC70500219BADB10AB64ED0DF9B366CAB00304F10403AA646F10D0EB7CD725CBA8

Function 00405D82 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DA0
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,004033B4,1033,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405DBB

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405D87
nsa, xrefs: 00405D8F
"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" , xrefs: 00405D82

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" $C:\Users\user\AppData\Local\Temp\$nsa
API String ID: 1716503409-2473440971
Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction ID: a69a53d4b23f3d63feeda802a3e8a765614c71270742c911b33c62312df6cecc
Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction Fuzzy Hash: 32F06D76600608BBDB008B59DD09AABBBB8EF91710F10803BEE01F7190E6B09A548B64

Function 00402BFF Relevance: 7.6, APIs: 5, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.ADVAPI32(?), ref: 00402C65
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Close$DeleteEnumOpen
String ID:
API String ID: 1912718029-0
Opcode ID: 58c60bd3f3897121054778c1da70f1d8408b3ab71b88223ff436e3f080a0af7a
Instruction ID: b9f5b7c8593eadded22e2ca3cbb8d83d08b5e31647f9888e60cfbaa55d101d4e
Opcode Fuzzy Hash: 58c60bd3f3897121054778c1da70f1d8408b3ab71b88223ff436e3f080a0af7a
Instruction Fuzzy Hash: 66116A71504119FFEF10AF90DF8CEAE3B79FB14384B10007AF905E11A0D7B58E55AA69

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76
windowtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction ID: 9ab6cbc1baff8286944736a18d7265b6422843b7a732a624d4201333bc7942cf
Opcode Fuzzy Hash: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction Fuzzy Hash: F2219071940209BEEF01AFB5CE4AABE7B75EF44744F10403EFA01B61D1D6B88A409B69

Function 0040604B Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,Remove folder: ,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00406075
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 00406096
RegCloseKey.KERNELBASE(?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,Remove folder: ,?), ref: 004060B9

Strings

Remove folder: , xrefs: 0040604E

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Remove folder:
API String ID: 3677997916-1958208860
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 0186f18981595c0b19feb364ea02d5f95392918b8fa258a18f8687652683a575
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 4501483115020AEADF21CF66ED08E9B3BA8EF84390B01402AF845D2220D735D964DBA5

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71registrystringCOMMON

Download Yara Rule

APIs

RegCreateKeyExW.KERNELBASE(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.KERNELBASE(?,?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction ID: d84b147cfae213de6894e87518a1957a70c03431d85ade02b305fde94438308f
Opcode Fuzzy Hash: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction Fuzzy Hash: E511C071E00108BFEB10AFA4DE89DAE777DEB14358F11403AF904B71D1DBB85E409668

Function 004038D5 Relevance: 6.0, APIs: 2, Strings: 2, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038E7
CloseHandle.KERNEL32(FFFFFFFF,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 004038FB

Strings

C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\, xrefs: 0040390B
C:\Users\user\AppData\Local\Temp\, xrefs: 004038DA

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Users\user\AppData\Local\Temp\$C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\
API String ID: 2962429428-1857124885
Opcode ID: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction ID: 23b98c188a40640ee87c89e263e7d2a3484f90a0975adae1b2ea6fd77d705eba
Opcode Fuzzy Hash: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction Fuzzy Hash: 78E086B14407149AC124AF7CAD495853A185F453357248726F178F20F0C778996B5E9D

Function 004015B9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405BDD: CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 004057AC: CreateDirectoryW.KERNELBASE(?,?,C:\Users\user\AppData\Local\Temp\), ref: 004057EF

SetCurrentDirectoryW.KERNEL32(?,C:\Program Files\TeamViewer\TVExtractTemp,?,00000000,000000F0), ref: 00401645

Strings

C:\Program Files\TeamViewer\TVExtractTemp, xrefs: 00401638

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID: C:\Program Files\TeamViewer\TVExtractTemp
API String ID: 1892508949-2667424760
Opcode ID: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction ID: 18abe7de9e9977a76830232601504265d2e6edcedfe07fce7f69d5744a4425eb
Opcode Fuzzy Hash: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction Fuzzy Hash: F911E631500504EBCF207FA0CD0199E3AB2EF44364B25453BF906B61F2DA3D4A819E5E

Function 00405C3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 00405BDD: CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

lstrlenW.KERNEL32(C:\,00000000,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405C93
GetFileAttributesW.KERNELBASE(C:\,C:\,C:\,C:\,C:\,C:\,00000000,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 00405CA3

Strings

C:\, xrefs: 00405C40, 00405C45, 00405C4B, 00405C8C, 00405C92, 00405C9A, 00405CA2

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: C:\
API String ID: 3248276644-3404278061
Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction ID: 790be11e20efdccda9c73cacd4945748764c6204d4d0b11914a12a4c94a1ccfd
Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction Fuzzy Hash: 41F0F925108F6515F62233790D05EAF2554CF82394755067FF891B12D1DB3C9D938C7D

Function 00406C7B Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction ID: 95c87b37ce546c92696c349aad8761a6baa0f42cb897a758cf539d426e2a5a70
Opcode Fuzzy Hash: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction Fuzzy Hash: 65A13471D00229CBDF28CFA8C844AADBBB1FF44305F15816AD956BB281D7785A86DF44

Function 00406E7C Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction ID: dd225a6952a4a1885b566de7f95e3528e0c965b1b64db9b9769652e5c735704b
Opcode Fuzzy Hash: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction Fuzzy Hash: 3D913370D04229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB291C7789A86DF45

Function 00406B92 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction ID: c728d5504c89e28601c55753f21d2f559f3974f1a6ce44cf054f885a45476dee
Opcode Fuzzy Hash: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction Fuzzy Hash: 06813471D04228CFDF24CFA8C844BADBBB1FB44305F25816AD856BB291C7789A86DF45

Function 00406697 Relevance: 5.2, APIs: 4, Instructions: 198COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction ID: 5389f57cfb4a3ea8b0a271fe5c21418892ef356aef38e154ca47b5156c43700c
Opcode Fuzzy Hash: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction Fuzzy Hash: 37816831D04229CBDF24CFA8C844BADBBB0FF44305F11816AD956BB281D7785986DF45

Function 00406AE5 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction ID: 7cecadd07089ef5f508d2048bcf4206a214b5fe31ba49bd0cdf53ec9cfb3ce0b
Opcode Fuzzy Hash: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction Fuzzy Hash: 35712175D04228CBDF28CFA8C844BADBBB1FB44305F15816AD806BB281D7789A96DF44

Function 00406C03 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction ID: f96eec566abe8136b7696836c8602221009d3abbc3cba5cf828ad5cd02611e0d
Opcode Fuzzy Hash: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction Fuzzy Hash: 56713371D04228CBEF28CFA8C844BADBBB1FF44305F15816AD856BB281C7789996DF45

Function 00406B4F Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction ID: 17f295adf0ba2181094cfffbed918b39bb4908eb68d6975640ddb9889f0749db
Opcode Fuzzy Hash: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction Fuzzy Hash: F2714531D04229CBEF28CF98C844BADBBB1FF44305F11816AD816BB291C7785A96DF44

Function 004031EF Relevance: 4.6, APIs: 3, Instructions: 101COMMON

Download Yara Rule

APIs

GetTickCount.KERNEL32 ref: 00403203

Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 00403236
SetFilePointer.KERNELBASE(04609CEA,00000000,00000000,00414ED0,00004000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000), ref: 00403331

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer$CountTick
String ID:
API String ID: 1092082344-0
Opcode ID: 60a078b62880e419fd8869ad6c2e376d7a0a18806c11cc7e2be6b3a6e40e2614
Instruction ID: 2fd669d0756999c0d63da40b5d988076205959dac08f3783f289fe1fafb1afdd
Opcode Fuzzy Hash: 60a078b62880e419fd8869ad6c2e376d7a0a18806c11cc7e2be6b3a6e40e2614
Instruction Fuzzy Hash: 19314B72500204DBD710DF69EEC49663FA9F74075A718423FE900F22E0CBB55D458B9D

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 24cdcc8e17645b09c8dba356bdc9c6051ea27a3cc416b1f1b75791a7a23ceb8f
Instruction ID: 135227bab5bbd0cb957ad13063370cb04025123e1843093ab7a3381522db9c00
Opcode Fuzzy Hash: 24cdcc8e17645b09c8dba356bdc9c6051ea27a3cc416b1f1b75791a7a23ceb8f
Instruction Fuzzy Hash: 7D21A731900219EBCF20AFA5CE48A9E7E71BF00354F20427BF511B51E1DBBD8A81DA5D

Function 00401B37 Relevance: 4.6, APIs: 2, Strings: 1, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BA7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9

Strings

InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!, xrefs: 00401B5E, 00401B64, 00401B7E

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Global$AllocFree
String ID: InstallTeamViewer(): Error!!! Installation files could not be extracted. Installation aborted!
API String ID: 3394109436-3224948528
Opcode ID: e295b54685931270dff86f202c2fdefb044b2b91f5e4e3df0bc5e06abf08786f
Instruction ID: 7cdfc3cbb2e69f4264c6c6693aec6085e55c642d7687a467de19211c04d07d9e
Opcode Fuzzy Hash: e295b54685931270dff86f202c2fdefb044b2b91f5e4e3df0bc5e06abf08786f
Instruction Fuzzy Hash: 67219672A00100EBDB20EB94CD85D5E77B6AF84314B21453BF502F72E1DA7898618F5D

Function 00402537 Relevance: 4.6, APIs: 3, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(0040ADD8,?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 0040258E

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID:
API String ID: 3109718747-0
Opcode ID: 850b0114aee89c8d8b14894d23efcefd65d0faa324c372d2657d007c57cf9cb9
Instruction ID: 4789cac02ba757069cd1743e95fa376523a080456913a55bd7acca95e4ec0b97
Opcode Fuzzy Hash: 850b0114aee89c8d8b14894d23efcefd65d0faa324c372d2657d007c57cf9cb9
Instruction Fuzzy Hash: CA11E772A01204BADB10AFB18F4EE9E32659F54355F20403BF502F65C1DAFC8E51576E

Function 004021EA Relevance: 4.6, APIs: 3, Instructions: 51stringCOMMON

Download Yara Rule

APIs

Part of subcall function 004064C1: FindFirstFileW.KERNELBASE(74DF3420,00426778,C:\,00405C83,C:\,C:\,00000000,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 004064CC
Part of subcall function 004064C1: FindClose.KERNEL32(00000000), ref: 004064D8

lstrlenW.KERNEL32 ref: 0040222A
lstrlenW.KERNEL32(00000000), ref: 00402235
SHFileOperationW.SHELL32(?,?,?,00000000), ref: 0040225E

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFindlstrlen$CloseFirstOperation
String ID:
API String ID: 1486964399-0
Opcode ID: f9a99ba4a91a9f4c9246cf651f25ea3f75fba1548a7733be5ccfd7ea764f24a6
Instruction ID: 9c43d8eab5e28b8efadc9e1ada5fd511aa80cab417b32b1cb638ddde26c09318
Opcode Fuzzy Hash: f9a99ba4a91a9f4c9246cf651f25ea3f75fba1548a7733be5ccfd7ea764f24a6
Instruction Fuzzy Hash: 4711707190021896CB10EFF98D4999EB7F8AF04314F10807FA905FB2DAE6B8D9018B69

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
Instruction ID: c7ec42ec2a5b8cbcf97019b844e04a4f9c539befeef3331d530b96059407f5ff
Opcode Fuzzy Hash: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
Instruction Fuzzy Hash: FCF03171A14204EBEB209F65DE8CABF767DEF80354B10843FF505B61D0DAB84D419B69

Function 00405927 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D2E: GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
Part of subcall function 00405D2E: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B09), ref: 00405942
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B09), ref: 0040594A
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405962

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction ID: ecea3d8082f0941e5ee01c5501cf82e541f4c7e763f85e657b920a2cf98d934c
Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction Fuzzy Hash: 6EE09B72105A91D6D21067349E0CB5F2AD8DF96335F09493EF595F11D0C778880ACA7D

Function 0040421B Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000408,?,00000000,00403E78), ref: 00404239

Strings

x, xrefs: 0040421B

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID: x
API String ID: 3850602802-2363233923
Opcode ID: 3e871ac91d012b6cae2f90b6371e3effc72337ca5df1d59cb8fc0e815e15e1ac
Instruction ID: 9e34857be529cc3efc5f0a7cea2a0d9e3d50e3e0a723924f26ebfb3191f04208
Opcode Fuzzy Hash: 3e871ac91d012b6cae2f90b6371e3effc72337ca5df1d59cb8fc0e815e15e1ac
Instruction Fuzzy Hash: 78C012B1240200FBCA209B00EE00B167A20F7A8702F2089BDF380200B086718822DB2D

Function 004030E7 Relevance: 3.1, APIs: 2, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 0040310C

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 5362526f818bdb809ad5cab08ae3c06d9fff902eb4395bb37ab99caf6aafdfc9
Instruction ID: 040f2acbe5348ef8c996952313d322865bd2faa87b76d8d9ba7109e69b0e4b3d
Opcode Fuzzy Hash: 5362526f818bdb809ad5cab08ae3c06d9fff902eb4395bb37ab99caf6aafdfc9
Instruction Fuzzy Hash: 22316B30200219EBDB108F55ED84ADA3F68EB08359F20813AF905EA1D0DB79DF50DBA9

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
Instruction ID: a4ed2935f8c713a64b441f8b02302a8faa8aa65f3841d01997d269d515fb9b23
Opcode Fuzzy Hash: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
Instruction Fuzzy Hash: 9D119131911205EBDB10CFA0CA489AEB7B4EF44354B20843FE446B72D0D6B85A41DB19

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D

Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040233E
RegCloseKey.ADVAPI32(00000000), ref: 00402347

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
Instruction ID: b5033fe3495a5d5fbf66e52db86fe43622c16bf705f2fe0f4142c4154f9543e6
Opcode Fuzzy Hash: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
Instruction Fuzzy Hash: 45F04F32A04110ABEB11BFB59B4EABE726A9B40314F15807BF501B71D5D9FC99025629

Function 004053B0 Relevance: 3.0, APIs: 2, Instructions: 32comCOMMON

Download Yara Rule

APIs

OleInitialize.OLE32(00000000), ref: 004053C0

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

CoUninitialize.COMBASE(00000404,00000000), ref: 0040540C

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: InitializeMessageSendUninitialize
String ID:
API String ID: 2896919175-0
Opcode ID: 3868b5a52622b10a1177551b7cc78a5ffd836502efb30cae45cbc154cdcfe80d
Instruction ID: fd15c1a48ffcd0bde852b119af7687a848e5b357f1d71b2c4b4b2b4c4c2fcb19
Opcode Fuzzy Hash: 3868b5a52622b10a1177551b7cc78a5ffd836502efb30cae45cbc154cdcfe80d
Instruction Fuzzy Hash: 55F0F076645601CBD3101B54AD05B5B7268EF80781F56407EEE44A23F1CABA48428B2E

Function 00406558 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
GetProcAddress.KERNEL32(00000000,?), ref: 00406585

Part of subcall function 004064E8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
Part of subcall function 004064E8: wsprintfW.USER32 ref: 0040653A
Part of subcall function 004064E8: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040654E

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 45558713834216164227cc70c45b1d33d53decf29647882cb75fd2fc812b7039
Instruction ID: 8c1a5bb66f910ccc430fc34c4425cef617f316e2833151c7c1ff8c8a0ee84b40
Opcode Fuzzy Hash: 45558713834216164227cc70c45b1d33d53decf29647882cb75fd2fc812b7039
Instruction Fuzzy Hash: C3E086326042206BD6105B706E0893762BC9ED8740302483EF946F2084D778DC329A6D

Function 00401DDC Relevance: 3.0, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,00000000,00000001), ref: 00401DF2
KiUserCallbackDispatcher.NTDLL(00000000,00000000), ref: 00401DFD

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CallbackDispatcherShowUserWindow
String ID:
API String ID: 82835404-0
Opcode ID: f95c109804867172db61b1135defe61bd419d678e2b077b04fc1289a75674494
Instruction ID: 21ddd3577add1129786b8edf5e015a7aca6159172531db4ba1f8ff50d12c07f3
Opcode Fuzzy Hash: f95c109804867172db61b1135defe61bd419d678e2b077b04fc1289a75674494
Instruction Fuzzy Hash: D3E08C326005009BCB20AFB5AA4999D3375EF50369710017BE402F10E1CABC9C408A2D

Function 00403932 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,74DF3420,00000000,74DF2EE0,00403909,C:\Users\user\AppData\Local\Temp\,00403708,?), ref: 0040394C
GlobalFree.KERNEL32(?), ref: 00403953

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction ID: 420717e04dc644aaadfe3aeddcd4797dc829437e29e913c3c6529364dabb0ba4
Opcode Fuzzy Hash: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction Fuzzy Hash: 41E012739011309BC6225F95ED44B5E7B6D6F95B32F0A423AE9807B26087B45D838FD8

Function 00405D53 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,80000000,00000003), ref: 00405D57
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19

Function 00405D2E Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 62c1218995ad43f24aa052634507c0d83541fa9dca801c4eab67991220ff17ac
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 40D01272504520AFC2513738EF0C89BBF95EB543B17028B35FAF9A22F0DB304C568A98

Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004033A9,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040582F
GetLastError.KERNEL32 ref: 0040583D

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction ID: d963a2520b22da8993c1f0374a54a6368e12bf2bf52e26206a68f99a8800bbf8
Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction Fuzzy Hash: 1DC04C31204B029AD7506B609F097177954AB50781F11C8396946E00A0DE348465DE2D

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
Instruction ID: 0f14848d4f24c16631b00b750435c060a764b4453362ef8260df6bafad2d34e7
Opcode Fuzzy Hash: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
Instruction Fuzzy Hash: 7FE01A71601114ABDB11EBA59E4ACAE766AAB40328B10443BF501F14E1CAB988619A2E

Function 0040229D Relevance: 1.5, APIs: 1, Instructions: 25COMMON

Download Yara Rule

APIs

WritePrivateProfileStringW.KERNEL32(00000000,00000000,?,00000000), ref: 004022D4

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: PrivateProfileStringWrite
String ID:
API String ID: 390214022-0
Opcode ID: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
Instruction ID: a822d11f1d05533bca3208a69e79300e3559a9020bae074bf72d5f6ed1f8f9d7
Opcode Fuzzy Hash: 014b14aad264ab3d9278ecb8b720997d0a3792ab61640f4b6d401bffeacc1512
Instruction Fuzzy Hash: BCE04F319001246ADB113EF10E8ED7F31695B40314B1405BFB551B66C6D9FC0D4246A9

Function 00405E05 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00410E7F,0040CED0,004032EF,0040CED0,00410E7F,00414ED0,00004000,?,00000000,00403119,00000004), ref: 00405E19

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileWrite
String ID:
API String ID: 3934441357-0
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: dac0b8971ba2920abb5474f128329a0fa477ab7403896bbfc0984bb8014ca22f
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 4AE08632100119ABCF105F50DC00EEB376CEB00350F004832FA65E2040E230EA219BE4

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction ID: ef45ff86538a2d51f1b0222ec8c1b297abd10be8bd22699319dc95f068cee933
Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction Fuzzy Hash: CCE08676244108BFDB00DFA8DE47FD537ECAB14700F004031BA08D70D1C674E5508768

Function 00405DD6 Relevance: 1.5, APIs: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,0040CED0,0040336B,0040A230,0040A230,0040326F,00414ED0,00004000,?,00000000,00403119), ref: 00405DEA

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileRead
String ID:
API String ID: 2738559852-0
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: f39de87387fc754cac4ceee649b5e38243fe2bf9183d254406dbd5143e25ae03
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 57E0EC3221125AABDF509F65DC08AEB7B6DEF05360F008837F955E6160D631E9219BE8

Function 004058C3 Relevance: 1.5, APIs: 1, Instructions: 21windowCOMMON

Download Yara Rule

APIs

MessageBoxIndirectW.USER32(0040A3E8), ref: 0040591E

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: IndirectMessage
String ID:
API String ID: 1874166685-0
Opcode ID: ad30b8c57171d568f185787def9c3cb3c84c161905c8a48c9e8b193500a59949
Instruction ID: 321c8730501e623a228f699c15320e1e2f592dc12f854a1532b6ac915461554a
Opcode Fuzzy Hash: ad30b8c57171d568f185787def9c3cb3c84c161905c8a48c9e8b193500a59949
Instruction Fuzzy Hash: CCF0F272A10701CBC768CF18EA44B1A3BE0E704304F50817AE854A23B0D77998E2DF1E

Function 004022DF Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402310

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction ID: 815fd251d1ef055c124add3867079dbd89389a2e6f50d5753089410e689aa70c
Opcode Fuzzy Hash: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction Fuzzy Hash: 91E04F30800208BBDF01AFA4CE49DBD3B79AF00344F14043AF940AB0D5E7F89A819749

Function 00404242 Relevance: 1.5, APIs: 1, Instructions: 10COMMON

Download Yara Rule

APIs

SetDlgItemTextW.USER32(?,?,00000000), ref: 0040425C

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ItemText
String ID:
API String ID: 3367045223-0
Opcode ID: 7233622df6a7a8fb633e185686b3ac587ee5e59de1f4571593d5d0ba3e8b76bd
Instruction ID: 65f8c73b99d4ee7bdc81e4beaf37a5475fca5134ded6dd21b3b8f91a9c360ad6
Opcode Fuzzy Hash: 7233622df6a7a8fb633e185686b3ac587ee5e59de1f4571593d5d0ba3e8b76bd
Instruction Fuzzy Hash: F2C04C76148200BFE641A755CC42F1FB799EF9431AF40C52EB59CE51D2C63994309A2A

Function 0040428E Relevance: 1.5, APIs: 1, Instructions: 9windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction ID: 8584b4a80e8197aea4c9dd325401cbfcfbe68695eba590e205f4256e4e85e437
Opcode Fuzzy Hash: c2a25a807fea80bd58a61b321fa2af33aa5b35e52655131f61520799e32131e4
Instruction Fuzzy Hash: 67C04C71740600BBDA20CB649D45F1677546754740F1448697640A60E0C674D420D62C

Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Function 00404277 Relevance: 1.5, APIs: 1, Instructions: 6windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction ID: 3e0bacd84e958153637e663f6e0df00a268db6e73930f78988907d41dcf2010e
Opcode Fuzzy Hash: 7bbf2f5232cd2574a5b007ccbcd78797cc8e3f4bb2dd07224d7ba7f17a9ad77c
Instruction Fuzzy Hash: 32B01235290A00FBDE214B00EE09F457E62F76C701F008478B340240F0CAB300B1DB19

Function 00404264 Relevance: 1.5, APIs: 1, Instructions: 4COMMON

Download Yara Rule

APIs

KiUserCallbackDispatcher.NTDLL(?,0040403C), ref: 0040426E

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CallbackDispatcherUser
String ID:
API String ID: 2492992576-0
Opcode ID: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction ID: ea629541fdd2228df96855dc4de4e407fdbb002a66502a1a5a86269346c048a7
Opcode Fuzzy Hash: 8a62e99fe4a67b047fdc914663d327e58adf51456459288db10dd5d3044e9a2e
Instruction Fuzzy Hash: C0A001B6644500ABCE129F90EF49D0ABBB2EBE8742B518579A285900348A364961EB59

Non-executed Functions

Function 00404C59 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C71
GetDlgItem.USER32(?,00000408), ref: 00404C7C
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CC6
LoadBitmapW.USER32(0000006E), ref: 00404CD9
SetWindowLongW.USER32(?,000000FC,00405251), ref: 00404CF2
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D06
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D18
SendMessageW.USER32(?,00001109,00000002), ref: 00404D2E
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3A
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D4C
DeleteObject.GDI32(00000000), ref: 00404D4F
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7A
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D86
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E1C
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E47
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E5B
GetWindowLongW.USER32(?,000000F0), ref: 00404E8A
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E98
ShowWindow.USER32(?,00000005), ref: 00404EA9
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FA6
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040500B
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405020
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405044
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405064
ImageList_Destroy.COMCTL32(?), ref: 00405079
GlobalFree.KERNEL32(?), ref: 00405089
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405102
SendMessageW.USER32(?,00001102,?,?), ref: 004051AB
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BA
InvalidateRect.USER32(?,00000000,00000001), ref: 004051DA
ShowWindow.USER32(?,00000000), ref: 00405228
GetDlgItem.USER32(?,000003FE), ref: 00405233
ShowWindow.USER32(00000000), ref: 0040523A

Strings

M, xrefs: 00404E03
, xrefs: 00405212
N, xrefs: 00404EE4

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: c57cb45ce89cd192e0511e30eec95623b06f81766ebd804847a276e94d887aeb
Instruction ID: ce840dee0c3a5b827351c7f25dbf2e3605d0905f5c54158640504e6bfb71dde6
Opcode Fuzzy Hash: c57cb45ce89cd192e0511e30eec95623b06f81766ebd804847a276e94d887aeb
Instruction Fuzzy Hash: 4C023EB0A00209EFDF209F64CD45AAE7BB5FB84355F10817AE610BA2E1C7799D52CF58

Function 004043DF Relevance: 42.2, APIs: 20, Strings: 4, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040447D
GetDlgItem.USER32(?,000003E8), ref: 00404491
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044AE
GetSysColor.USER32(?), ref: 004044BF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044CD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044DB
lstrlenW.KERNEL32(?), ref: 004044E0
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044ED
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404502
GetDlgItem.USER32(?,0000040A), ref: 0040455B
SendMessageW.USER32(00000000), ref: 00404562
GetDlgItem.USER32(?,000003E8), ref: 0040458D
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D0
LoadCursorW.USER32(00000000,00007F02), ref: 004045DE
SetCursor.USER32(00000000), ref: 004045E1
ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,00000001), ref: 004045F6
LoadCursorW.USER32(00000000,00007F00), ref: 00404602
SetCursor.USER32(00000000), ref: 00404605
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404634
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404646

Strings

open, xrefs: 004045EE
VC@, xrefs: 004045EB
Remove folder: , xrefs: 004045BC
N, xrefs: 0040457B

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$Remove folder: $VC@$open
API String ID: 3615053054-2721566001
Opcode ID: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction ID: ef28e404984a924d02769b335405a58d84a4f5c10dd13b46e9d300bde90bb2c1
Opcode Fuzzy Hash: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction Fuzzy Hash: 717191B1A00209BFDB10AF60DD45E6A7B69FB94344F00843AFB05B62E0D779AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4

Function 004046DD Relevance: 24.8, APIs: 10, Strings: 4, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040472C
SetWindowTextW.USER32(00000000,?), ref: 00404756
SHBrowseForFolderW.SHELL32(?), ref: 00404807
CoTaskMemFree.OLE32(00000000), ref: 00404812
lstrcmpiW.KERNEL32(Remove folder: ,00423728,00000000,?,?), ref: 00404844
lstrcatW.KERNEL32(?,Remove folder: ), ref: 00404850
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404862

Part of subcall function 004058A7: GetDlgItemTextW.USER32(?,?,00000400,00404899), ref: 004058BA

Part of subcall function 00406412: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
Part of subcall function 00406412: CharNextW.USER32(?,?,?,00000000), ref: 00406484
Part of subcall function 00406412: CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
Part of subcall function 00406412: CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404925
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404940

Part of subcall function 00404A99: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
Part of subcall function 00404A99: wsprintfW.USER32 ref: 00404B43
Part of subcall function 00404A99: SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

(7B, xrefs: 004047DA
Remove folder: , xrefs: 0040483E, 00404843, 0040484E
C:\Program Files\TeamViewer, xrefs: 0040482D
A, xrefs: 00404800

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Program Files\TeamViewer$Remove folder:
API String ID: 2624150263-2772811393
Opcode ID: c0b61ef350f3b11f3d6e2819161bdb8859453bf742527bbdd3f0f7a625ed1280
Instruction ID: d5aaf60bd55b21875b9c8b9a8d0b3d7e01f34e6f89f3adcbdcc63617e1d21faf
Opcode Fuzzy Hash: c0b61ef350f3b11f3d6e2819161bdb8859453bf742527bbdd3f0f7a625ed1280
Instruction Fuzzy Hash: B7A191F1A00209ABDB11AFA5CC45AAF77B8EF84354F10847BF601B62D1D77C99418B6D

Function 00405EAD Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00426DC8,NUL,?,00000000,?,?,00406040,?,?), ref: 00405EBC
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9

Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
wsprintfA.USER32 ref: 00405F24
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
GlobalFree.KERNEL32(00000000), ref: 0040600D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406014

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Strings

NUL, xrefs: 00405EB6
[Rename], xrefs: 00405F8E, 00405FA0
%ls=%ls, xrefs: 00405F1A

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: 30f1ad71034d6c445b7df81822845e1e30d199c7f1bc078365d62d19a968fdd2
Instruction ID: 52ae09e4e2a5e81e4d5588e003ad531eff1fe7f7ae6e2de5146a23cae23f7ad9
Opcode Fuzzy Hash: 30f1ad71034d6c445b7df81822845e1e30d199c7f1bc078365d62d19a968fdd2
Instruction Fuzzy Hash: EB315330241B19BBD2206B209D08F2B3A5CEF85758F15043BF942F62C2EA7CC9118EBD

Function 00406412 Relevance: 12.3, APIs: 4, Strings: 3, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406475
CharNextW.USER32(?,?,?,00000000), ref: 00406484
CharNextW.USER32(?,00000000,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00406489
CharPrevW.USER32(?,?,74DF3420,C:\Users\user\AppData\Local\Temp\,"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" ,00403391,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 0040649C

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00406413
"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" , xrefs: 00406412
*?|<>/":, xrefs: 00406464

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" $*?|<>/":$C:\Users\user\AppData\Local\Temp\
API String ID: 589700163-2343300199
Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction ID: c1b46f2de1f90aebbf911330ce555e940da56993e608f70b6a8db31027969b8c
Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction Fuzzy Hash: 5311C85680121299DB307B588C40AB7A2B8EF55754F52803FEDCA732C1E77C5C9286BD

Function 004042A9 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042C6
GetSysColor.USER32(00000000), ref: 004042E2
SetTextColor.GDI32(?,00000000), ref: 004042EE
SetBkMode.GDI32(?,?), ref: 004042FA
GetSysColor.USER32(?), ref: 0040430D
SetBkColor.GDI32(?,?), ref: 0040431D
DeleteObject.GDI32(?), ref: 00404337
CreateBrushIndirect.GDI32(?), ref: 00404341

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: 2a82f640caf94e13ad52f77eccc7f6a005bf570db5d4005cc44859485eb84fad
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 9F215171600704ABCB219F68DE08B4BBBF8AF81714F04892DED95E26A0D738E904CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405E34: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4A

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction ID: fbd7f9394f7a40dbbdef10ea3a20ac1ae57b35180e29dd1ddeb30b88b5afce05
Opcode Fuzzy Hash: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction Fuzzy Hash: 19510774D00219ABDF209F94CA88AAEB779FF04344F50447BE501B72E0D7B99982DB69

Function 00404BA7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC2
GetMessagePos.USER32 ref: 00404BCA
ScreenToClient.USER32(?,?), ref: 00404BE4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BF6
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C1C

Strings

f, xrefs: 00404BF8

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 45e0f6331f39cfe7836e80c9775163861a3897288b26a0b158bc224782e9bc0b
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: C9015271901218BAEB00DB94DD45FFEBBBCAF54711F10012BBA51B61D0C7B495018B54

Function 00401D56 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401DD1

Strings

Tahoma, xrefs: 00401DB7

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID: Tahoma
API String ID: 3808545654-3580928618
Opcode ID: 5a25ca78bc8c32752d7f72089744ea34f9941ea911f474610dde7174e3f6db02
Instruction ID: 9e8fd183d3d9d3ef172346538d4b27734d94fdc92d2c471f4f64b2fa811a60c8
Opcode Fuzzy Hash: 5a25ca78bc8c32752d7f72089744ea34f9941ea911f474610dde7174e3f6db02
Instruction Fuzzy Hash: F601A271544641EFEB016BB0AF4AF9A3F75BB65301F104579F152B61E2CA7C0006AB2D

Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36timeCOMMON

Download Yara Rule

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
wsprintfW.USER32 ref: 00402D56
SetWindowTextW.USER32(?,?), ref: 00402D66
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D78

Strings

verifying installer: %d%%, xrefs: 00402D4B, 00402D54
unpacking data: %d%%, xrefs: 00402D44

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: 3598370c3c9dfc29f84c7b8ed24a957720a686991d5537ef1c6dff233380f4e6
Instruction ID: 006a23aec332b8a1771af90dfa9c1e08c84c5b856183a3bf167901723993fe13
Opcode Fuzzy Hash: 3598370c3c9dfc29f84c7b8ed24a957720a686991d5537ef1c6dff233380f4e6
Instruction Fuzzy Hash: 2FF0367050020CABEF206F50DD49BEA3B69FF44305F00803AFA55B51D0DBF959558F59

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: e8b18edfeea79fa09e45a72486dc9901f693ae42d48326bb65f86fff18046ac9
Instruction ID: 9003099e8900d80eaa65f9bf21adae6f43ee9946aaa6f9d478ae9c17af360c06
Opcode Fuzzy Hash: e8b18edfeea79fa09e45a72486dc9901f693ae42d48326bb65f86fff18046ac9
Instruction Fuzzy Hash: D6216F72801118BBCF216FA5CE49D9E7F79EF09364F24423AF550762E0CB794E419B98

Function 00404A99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
wsprintfW.USER32 ref: 00404B43
SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

(7B, xrefs: 00404B2C
%u.%u%s%s, xrefs: 00404B24

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 81ae9ae8dc439d9931515dbc50321e52771afc0a6870d61e722dcea37f1a3983
Instruction ID: 8555a1dc09e6b234f76c08cd80d60a8511de1cbf1cdbca66d7a603e4fd23a7b2
Opcode Fuzzy Hash: 81ae9ae8dc439d9931515dbc50321e52771afc0a6870d61e722dcea37f1a3983
Instruction Fuzzy Hash: E911EB736441283BDB0095AD9C45F9E3298DB85378F150237FA26F71D1DA79D82286EC

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction ID: c287ee2e14a47dfcdc45124cadc9b4dd0eb33b5564dd8f2f51e592e83ba53e14
Opcode Fuzzy Hash: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction Fuzzy Hash: 33F0E172600504AFD701DBE4DE88CEEBBBDEB48311B104476F541F51A1CA749D018B38

Function 00405BDD Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 42COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,?,C:\,?,00405C51,C:\,C:\,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
CharNextW.USER32(00000000), ref: 00405BF0
CharNextW.USER32(00000000), ref: 00405C08

Strings

C:\, xrefs: 00405BDE

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext
String ID: C:\
API String ID: 3213498283-3404278061
Opcode ID: 97bda6209b414f3be7afdaeea7f60dfeaed0a7be6e9491b65ace1fa1eacd3bf0
Instruction ID: 6e78a38a92844ebddfb5a00e32717de03c0cdfda6ab0f65e84db47d2e3257ff5
Opcode Fuzzy Hash: 97bda6209b414f3be7afdaeea7f60dfeaed0a7be6e9491b65ace1fa1eacd3bf0
Instruction Fuzzy Hash: 83F0B411949F1D95FF3177584C45A7BA7BCEB55360B00803BEA41B72C1D7B84C818EEA

Function 00405B32 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B38
CharPrevW.USER32(?,00000000,?,C:\Users\user\AppData\Local\Temp\,004033A3,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,C:\Users\user\AppData\Local\Temp\,004035DE), ref: 00405B42
lstrcatW.KERNEL32(?,0040A014), ref: 00405B54

Strings

C:\Users\user\AppData\Local\Temp\, xrefs: 00405B32

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharPrevlstrcatlstrlen
String ID: C:\Users\user\AppData\Local\Temp\
API String ID: 2659869361-3081826266
Opcode ID: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction ID: 1c34604f245f66d13fb295c2dca74b2082213948d97efa3850964b8affffb698
Opcode Fuzzy Hash: 50926409037afd5c3b117ee0fc1a0f088670877cc81c495d68363141157855c1
Instruction Fuzzy Hash: 57D05E31101934AAC2116B448C04DDB73AC9E46304341442AF201B70A6C778695286FD

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52synchronizationCOMMON

Download Yara Rule

APIs

Part of subcall function 004052DD: lstrlenW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00402E19,00402E19,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\,Remove folder: C:\Users\user\AppData\Local\Temp\nsp52DB.tmp\), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Part of subcall function 0040585E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
Part of subcall function 0040585E: CloseHandle.KERNEL32(?), ref: 00405894

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNEL32(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: bb4ed085c638bd443c710e2d7f0342cbaf51ccc2adafb456e5dd98b29d2a060b
Instruction ID: 5702df78c33f9bd13decba52644e1012fe72a42f767711efff684f6f7274af03
Opcode Fuzzy Hash: bb4ed085c638bd443c710e2d7f0342cbaf51ccc2adafb456e5dd98b29d2a060b
Instruction Fuzzy Hash: FF11A131900508EBCF21AF91CD4499E7AB6AF40314F21407BFA05B61F1D7798A92DB99

Function 00403C9D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 71COMMON

Download Yara Rule

APIs

SetWindowTextW.USER32(00000000,00429240), ref: 00403D35

Strings

"C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" , xrefs: 00403C9E
1033, xrefs: 00403CA1, 00403CAB, 00403D1C

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: TextWindow
String ID: "C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe" $1033
API String ID: 530164218-1918039036
Opcode ID: 9d022d01f112da27556ef407cc074c94f0222ef42f22569fe4f3b5c0e17e7ae8
Instruction ID: 4786a0dcc4ba2f930af81554b1ec9cb86176e7a1d2ad565e9f211a7c6dcc4e6b
Opcode Fuzzy Hash: 9d022d01f112da27556ef407cc074c94f0222ef42f22569fe4f3b5c0e17e7ae8
Instruction Fuzzy Hash: 7111C331B44210ABD7359F15EC40A337B6CEF85715B28427BE801AB3A1C63A9D1296A9

Function 00405251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405280
CallWindowProcW.USER32(?,?,?,?), ref: 004052D1

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Strings

, xrefs: 00405261

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction ID: 35360b72f4910b777185a6264b25dc7760dbd7dc789205491e41d57b326ac1ec
Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction Fuzzy Hash: 6B019E71210708ABDF208F11DD84E9B3A35EF94321F60443AFA00761D1C77A8D529E6A

Function 0040585E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
CloseHandle.KERNEL32(?), ref: 00405894

Strings

Error launching installer, xrefs: 00405871

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction ID: 0fb7bd0647ee639374dbc29985885c8cd5f4694ddcbbc5ba66c50ad851a9a680
Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction Fuzzy Hash: 22E04FB0A002097FEB009B64ED45F7B77ACEB04208F408431BD00F2150D77498248A78

Function 00405B7E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 16stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(80000000,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,00402EAD,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,80000000,00000003), ref: 00405B84
CharPrevW.USER32(80000000,00000000,80000000,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,00402EAD,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696\TeamViewer_.exe,80000000,00000003), ref: 00405B94

Strings

C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696, xrefs: 00405B7E

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharPrevlstrlen
String ID: C:\Users\user\AppData\Local\Temp\nsz4618.tmp\nsu4696
API String ID: 2709904686-3053395492
Opcode ID: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction ID: 87bbc210c64b19a6b78a00595756172ded5dec919d443e3f73ce50da7c0279be
Opcode Fuzzy Hash: 1e2f59ad4ff0707ecda417660e1f53ddee00da6e1af2314932cd9a88429354c1
Instruction Fuzzy Hash: D4D05EB24009209AD312AB04DD00DAF77ACEF163007464426E841AB166D778BC8186BC

Function 00405CB8 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CE0
CharNextA.USER32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF1
lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

Memory Dump Source

Source File: 00000006.00000002.2460892038.0000000000401000.00000020.00000001.01000000.0000000C.sdmp, Offset: 00400000, based on PE: true

Associated: 00000006.00000002.2460836044.0000000000400000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460916054.0000000000408000.00000002.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000040A000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000422000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000425000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000042C000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000430000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000435000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.0000000000460000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2460938614.000000000047B000.00000004.00000001.01000000.0000000C.sdmpDownload File
Associated: 00000006.00000002.2461249990.0000000000486000.00000002.00000001.01000000.0000000C.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_6_2_400000_TeamViewer_.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction ID: b09c91cad7c2282b041c35ea214dbdd3f15ee75aa50bf55fe933874c09a5e2ef
Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction Fuzzy Hash: BFF0F631104954FFD702DFA5DD04E9FBBA8EF06350B2180BAE841F7210D674DE01ABA8

Analysis Process: TeamViewer_.exePID: 7968, Parent PID: 1044COMMON

Execution Graph

Execution Coverage:	20.8%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	0%
Total number of Nodes:	1343
Total number of Limit Nodes:	40

Executed Functions

Function 004033B6 Relevance: 84.4, APIs: 34, Strings: 14, Instructions: 401
stringfilecomCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetErrorMode.KERNELBASE ref: 004033D9
GetVersion.KERNEL32 ref: 004033DF
lstrlenA.KERNEL32(UXTHEME,UXTHEME), ref: 00403408
#17.COMCTL32(00000007,00000009), ref: 0040342B
OleInitialize.OLE32(00000000), ref: 00403432
SHGetFileInfoW.SHELL32(004216E8,00000000,?,000002B4,00000000), ref: 0040344E
GetCommandLineW.KERNEL32(00429240,NSIS Error), ref: 00403463
GetModuleHandleW.KERNEL32(00000000,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000), ref: 00403476
CharNextW.USER32(00000000,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000020), ref: 0040349D

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

GetTempPathW.KERNEL32(00000400,00437800), ref: 004035D7
GetWindowsDirectoryW.KERNEL32(00437800,000003FB), ref: 004035E8
lstrcatW.KERNEL32(00437800,\Temp), ref: 004035F4
GetTempPathW.KERNEL32(000003FC,00437800,00437800,\Temp), ref: 00403608
lstrcatW.KERNEL32(00437800,Low), ref: 00403610
SetEnvironmentVariableW.KERNEL32(TEMP,00437800,00437800,Low), ref: 00403621
SetEnvironmentVariableW.KERNEL32(TMP,00437800), ref: 00403629
DeleteFileW.KERNELBASE(00437000), ref: 0040363D

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

ExitProcess.KERNEL32(?), ref: 00403703
CoUninitialize.COMBASE(?), ref: 00403708
ExitProcess.KERNEL32 ref: 00403729
lstrcatW.KERNEL32(00437800,~nsu,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 0040373C
lstrcatW.KERNEL32(00437800,0040A328,00437800,~nsu,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 0040374B
lstrcatW.KERNEL32(00437800,.tmp,00437800,~nsu,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 00403756
lstrcmpiW.KERNEL32(00437800,00436800,00437800,.tmp,00437800,~nsu,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000,?), ref: 00403762
SetCurrentDirectoryW.KERNEL32(00437800,00437800), ref: 0040377E
DeleteFileW.KERNEL32(00420EE8,00420EE8,?,0042B000,?), ref: 004037D8
CopyFileW.KERNEL32(C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,00420EE8,00000001), ref: 004037EC
CloseHandle.KERNEL32(00000000,00420EE8,00420EE8,?,00420EE8,00000000), ref: 00403819
GetCurrentProcess.KERNEL32(00000028,?), ref: 00403848
OpenProcessToken.ADVAPI32(00000000), ref: 0040384F
LookupPrivilegeValueW.ADVAPI32(00000000,SeShutdownPrivilege,?), ref: 00403864
AdjustTokenPrivileges.ADVAPI32 ref: 00403887
ExitWindowsEx.USER32(00000002,80040002), ref: 004038AC
ExitProcess.KERNEL32 ref: 004038CF

Strings

TMP, xrefs: 00403624
NSIS Error, xrefs: 00403454
.tmp, xrefs: 00403750
UXTHEME, xrefs: 004033FC, 00403401, 00403407
Error launching installer, xrefs: 004036BF
C:\Program Files\TeamViewer, xrefs: 004035BA, 004036DA, 00403784, 0040378E
\Temp, xrefs: 004035EE
~nsu, xrefs: 00403734
TEMP, xrefs: 0040361C
Low, xrefs: 0040360A
Error writing temporary file. Make sure your temp folder is valid., xrefs: 004033CD
C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe, xrefs: 004037E7
"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00403469, 0040346F, 00403665
SeShutdownPrivilege, xrefs: 0040385E

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Processlstrcat$ExitFile$Handle$CurrentDeleteDirectoryEnvironmentModulePathTempTokenVariableWindows$AddressAdjustCharCloseCommandCopyErrorInfoInitializeLineLookupModeNextOpenPrivilegePrivilegesProcUninitializeValueVersionlstrcmpilstrcpynlstrlen
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$.tmp$C:\Program Files\TeamViewer$C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Low$NSIS Error$SeShutdownPrivilege$TEMP$TMP$UXTHEME$\Temp$~nsu
API String ID: 354199918-3051870712
Opcode ID: adc4d748d9836f5a15988fa3e2f94b2f0245c9efab62edd68d6b1bb0daacd0ec
Instruction ID: be8551fa6605ebbbfda7487142ffb020be8bd547a3943651712312bea09c5587
Opcode Fuzzy Hash: adc4d748d9836f5a15988fa3e2f94b2f0245c9efab62edd68d6b1bb0daacd0ec
Instruction Fuzzy Hash: AED10571200300ABE7207F659D49A2B3AEDEB4074AF50443FF881B62D2DB7C8956876E

Function 0040596F Relevance: 17.6, APIs: 7, Strings: 3, Instructions: 148
filestringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DeleteFileW.KERNELBASE(?,?,74DF3420,74DF2EE0,00000000), ref: 00405998
lstrcatW.KERNEL32(C:\Windows\TEMP\nsfB965.tmp\*.*,\*.*,C:\Windows\TEMP\nsfB965.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 004059E0
lstrcatW.KERNEL32(?,0040A014,?,C:\Windows\TEMP\nsfB965.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A03
lstrlenW.KERNEL32(?,?,0040A014,?,C:\Windows\TEMP\nsfB965.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A09
FindFirstFileW.KERNELBASE(C:\Windows\TEMP\nsfB965.tmp\*.*,?,?,?,0040A014,?,C:\Windows\TEMP\nsfB965.tmp\*.*,?,?,74DF3420,74DF2EE0,00000000), ref: 00405A19
FindNextFileW.KERNELBASE(00000000,00000010,000000F2,?,?,?,?,0000002E), ref: 00405AB9
FindClose.KERNEL32(00000000), ref: 00405AC8

Strings

C:\Windows\TEMP\nsfB965.tmp\*.*, xrefs: 004059C8, 004059CE, 004059DF, 00405A18
"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 0040596F
\*.*, xrefs: 004059DA

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFind$lstrcat$CloseDeleteFirstNextlstrlen
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$C:\Windows\TEMP\nsfB965.tmp\*.*$\*.*
API String ID: 2035342205-948673885
Opcode ID: caf8ebbf86a4c95ad3815d748c14af6cf0a222b2c55ec9266b14322c72a8a4f6
Instruction ID: 6c547db7f4d1248ed83a6ec2b2b7cf99957869ea0eb35c9edb1a86952611c1c3
Opcode Fuzzy Hash: caf8ebbf86a4c95ad3815d748c14af6cf0a222b2c55ec9266b14322c72a8a4f6
Instruction Fuzzy Hash: 5A41B530A40914A6CB21AB659CC9AAF7678EF41724F20427FF801711D1D77C5986DE6E

Function 00406846 Relevance: 5.4, APIs: 4, Instructions: 382COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction ID: 84f5b91c3f937eb173619b21672ae23043901769df73ed9f159891f0fc81c8d0
Opcode Fuzzy Hash: ead38b7015f9474378dd182d16c601773bd961a48b8ca1aefc3332049c463b86
Instruction Fuzzy Hash: 72F18671D04229CBDF18CFA8C8946ADBBB0FF45305F25816ED856BB281D7385A8ACF45

Function 004064C1 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 14fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(74DF3420,00426778,00425F30,00405C83,00425F30,00425F30,00000000,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 004064CC
FindClose.KERNELBASE(00000000), ref: 004064D8

Strings

xgB, xrefs: 004064C2

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID: xgB
API String ID: 2295610775-399326502
Opcode ID: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction ID: 909a2899cbbcfc21b24ab628f9350e7a3c7b3772aa6d432f74911df6ac2d0bb5
Opcode Fuzzy Hash: 4403a27f78f835125bd15cd158b53f866fd18ebbb8f54cd400289453990cbd04
Instruction Fuzzy Hash: 8BD0C9315045209BC2111778AE4C85B7A98AF553317628A36B466F12A0C674CC22869C

Function 004027FB Relevance: 1.5, APIs: 1, Instructions: 30fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNELBASE(00000000,?,00000002), ref: 0040280A

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFindFirst
String ID:
API String ID: 1974802433-0
Opcode ID: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
Instruction ID: ca82d2f7608ddbe9a9db451b4e667c54ef54e9945bbc135f2cbc761c4928cd6d
Opcode Fuzzy Hash: 760ba12aea5bac669ea06a92ce868f6cfbbc58d79179603cd607c726fd559e33
Instruction Fuzzy Hash: 3CF08275600114DBC711EBE4DD49AAEB374FF00324F2045BBE105F31E1D7B499559B2A

Function 004039C7 Relevance: 42.2, APIs: 13, Strings: 11, Instructions: 215
stringregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00406558: GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
Part of subcall function 00406558: GetProcAddress.KERNEL32(00000000,?), ref: 00406585

lstrcatW.KERNEL32(00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00000000), ref: 00403A48
lstrlenW.KERNEL32(004281E0,?,?,?,004281E0,00000000,C:\Program Files\TeamViewer,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000,00000002,74DF3420), ref: 00403AC8
lstrcmpiW.KERNEL32(004281D8,.exe,004281E0,?,?,?,004281E0,00000000,C:\Program Files\TeamViewer,00437000,00423728,80000001,Control Panel\Desktop\ResourceLocale,00000000,00423728,00000000), ref: 00403ADB
GetFileAttributesW.KERNEL32(004281E0), ref: 00403AE6
LoadImageW.USER32(00000067,00000001,00000000,00000000,00008040,C:\Program Files\TeamViewer), ref: 00403B2F

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

RegisterClassW.USER32(004291E0), ref: 00403B6C
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00403B84
CreateWindowExW.USER32(00000080,_Nb,00000000,80000000,?,?,?,?,00000000,00000000,00000000), ref: 00403BB9
ShowWindow.USER32(00000005,00000000), ref: 00403BEF
GetClassInfoW.USER32(00000000,RichEdit20W,004291E0), ref: 00403C1B
GetClassInfoW.USER32(00000000,RichEdit,004291E0), ref: 00403C28
RegisterClassW.USER32(004291E0), ref: 00403C31
DialogBoxParamW.USER32(?,00000000,00403D6A,00000000), ref: 00403C50

Strings

(7B, xrefs: 004039F3
Control Panel\Desktop\ResourceLocale, xrefs: 004039FB
RichEd20, xrefs: 00403BF5
.DEFAULT\Control Panel\International, xrefs: 00403A33
RichEd32, xrefs: 00403C03
"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 004039CB
RichEdit, xrefs: 00403C22
RichEdit20W, xrefs: 00403C13, 00403C19
_Nb, xrefs: 00403B4B, 00403BB3
C:\Program Files\TeamViewer, xrefs: 00403A57, 00403A5F, 00403B02, 00403B08, 00403B18
.exe, xrefs: 00403AD5

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Class$Info$RegisterWindow$AddressAttributesCreateDialogFileHandleImageLoadModuleParamParametersProcShowSystemlstrcatlstrcmpilstrlenwsprintf
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$(7B$.DEFAULT\Control Panel\International$.exe$C:\Program Files\TeamViewer$Control Panel\Desktop\ResourceLocale$RichEd20$RichEd32$RichEdit$RichEdit20W$_Nb
API String ID: 1975747703-3034445695
Opcode ID: d6eb97ecc45ceecdb0e2d203f76fda1198e4e833a1627c35b81ac0c75580ce77
Instruction ID: e7f44595d902892b35b801f2f0c3734befc0b18a393fec54347386a87508d522
Opcode Fuzzy Hash: d6eb97ecc45ceecdb0e2d203f76fda1198e4e833a1627c35b81ac0c75580ce77
Instruction Fuzzy Hash: 8661C570244200BAD730AF669D49E2B3A7CEB84B49F40453FF981B62E2DB7D5912C63D

Function 00402E41 Relevance: 24.7, APIs: 5, Strings: 9, Instructions: 203
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00402E55
GetModuleFileNameW.KERNEL32(00000000,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,00000400), ref: 00402E71

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

GetFileSize.KERNEL32(00000000,00000000,00439000,00000000,00436800,00436800,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00402EBA
GlobalAlloc.KERNELBASE(00000040,0040A230), ref: 00403001

Strings

Inst, xrefs: 00402F28
Null, xrefs: 00402F3A
dVA, xrefs: 004030C6
Error writing temporary file. Make sure your temp folder is valid., xrefs: 0040304A
C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe, xrefs: 00402E5B, 00402E6A, 00402E7E, 00402E9B
Error launching installer, xrefs: 00402E91
"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00402E41
Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author , xrefs: 00403098
soft, xrefs: 00402F31

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$AllocAttributesCountCreateGlobalModuleNameSizeTick
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe$Error launching installer$Error writing temporary file. Make sure your temp folder is valid.$Inst$Installer integrity check has failed. Common causes includeincomplete download and damaged media. Contact theinstaller's author $Null$dVA$soft
API String ID: 2803837635-3649123712
Opcode ID: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
Instruction ID: e866f1dd798e5fb15c0a347603bcfded6ce2f229c2e481af73dd86df93422dd6
Opcode Fuzzy Hash: cc8dbefb85167051c5f544e5004306f35bb35ae70e2c75d84afc589ab8111160
Instruction Fuzzy Hash: 9761C431A00215ABDB209F75DD49B9E7BB8EB00359F20817FF500F62D1DABD9A448B5D

Function 004061A0 Relevance: 17.7, APIs: 8, Strings: 2, Instructions: 207
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersion.KERNEL32(00000000,00422708,?,00405314,00422708,00000000,00000000,00000000), ref: 00406263
GetSystemDirectoryW.KERNEL32(004281E0,00000400), ref: 004062E1
GetWindowsDirectoryW.KERNEL32(004281E0,00000400), ref: 004062F4
SHGetSpecialFolderLocation.SHELL32(?,?), ref: 00406330
SHGetPathFromIDListW.SHELL32(?,004281E0), ref: 0040633E
CoTaskMemFree.OLE32(?), ref: 00406349
lstrcatW.KERNEL32(004281E0,\Microsoft\Internet Explorer\Quick Launch), ref: 0040636D
lstrlenW.KERNEL32(004281E0,00000000,00422708,?,00405314,00422708,00000000,00000000,00000000), ref: 004063C7

Strings

\Microsoft\Internet Explorer\Quick Launch, xrefs: 00406367
Software\Microsoft\Windows\CurrentVersion, xrefs: 004062AF

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Directory$FolderFreeFromListLocationPathSpecialSystemTaskVersionWindowslstrcatlstrlen
String ID: Software\Microsoft\Windows\CurrentVersion$\Microsoft\Internet Explorer\Quick Launch
API String ID: 900638850-730719616
Opcode ID: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
Instruction ID: 57c77dc533264c97ace6329bd87f7d674c2bea75a5b3d90d15d675b8bae5a73d
Opcode Fuzzy Hash: 978d560dfc87019ac3657ebba0841bd774ce65c1ae89d16051c02eb976f42344
Instruction Fuzzy Hash: 1E611571A00104EBDF209F24CC40AAE37A5AF15314F56817FED56BA2D0D73D8AA2CB9D

Function 00402D9F Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 51
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DestroyWindow.USER32(00000000,00000000), ref: 00402DBA
GetTickCount.KERNEL32 ref: 00402DD8
wsprintfW.USER32 ref: 00402E06

Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

CreateDialogParamW.USER32(0000006F,00000000,00402D04,00000000), ref: 00402E2A
ShowWindow.USER32(00000000,00000005), ref: 00402E38

Part of subcall function 00402D83: MulDiv.KERNEL32(00000000,00000064,00001796), ref: 00402D98

Strings

... %d%%, xrefs: 00402E00

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSendWindow$lstrlen$CountCreateDestroyDialogParamShowTextTicklstrcatwsprintf
String ID: ... %d%%
API String ID: 722711167-2449383134
Opcode ID: 55d24c5390b907b95f49b66e4ea6ad5927533a63874c6edf844c1ebc3ef3af3f
Instruction ID: 67f39cb704aca6262626a7976268bb3bb8a333bdab68892006d91dd8afb4411f
Opcode Fuzzy Hash: 55d24c5390b907b95f49b66e4ea6ad5927533a63874c6edf844c1ebc3ef3af3f
Instruction Fuzzy Hash: 96016D70541614EBC721AB60EF4DA9B7A68AF00706B14417FF885F12E0CBF85865CBEE

Function 00402D04 Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 36
timeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

SetTimer.USER32(?,00000001,000000FA,00000000), ref: 00402D22
wsprintfW.USER32 ref: 00402D56
SetWindowTextW.USER32(?,?), ref: 00402D66
SetDlgItemTextW.USER32(?,00000406,?), ref: 00402D78

Strings

unpacking data: %d%%, xrefs: 00402D44
verifying installer: %d%%, xrefs: 00402D4B, 00402D54

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Text$ItemTimerWindowwsprintf
String ID: unpacking data: %d%%$verifying installer: %d%%
API String ID: 1451636040-1158693248
Opcode ID: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction ID: 006a23aec332b8a1771af90dfa9c1e08c84c5b856183a3bf167901723993fe13
Opcode Fuzzy Hash: f920e2d473a8442ab140d7cb001c2dea54e1cd42605ecc10fb631262ba466dce
Instruction Fuzzy Hash: 2FF0367050020CABEF206F50DD49BEA3B69FF44305F00803AFA55B51D0DBF959558F59

Function 004064E8 Relevance: 10.5, APIs: 3, Strings: 3, Instructions: 36
libraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
wsprintfW.USER32 ref: 0040653A
LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040654E

Strings

%s%S.dll, xrefs: 00406534
UXTHEME, xrefs: 004064F1
\, xrefs: 00406510

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: DirectoryLibraryLoadSystemwsprintf
String ID: %s%S.dll$UXTHEME$\
API String ID: 2200240437-1946221925
Opcode ID: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction ID: c6b4a3c42f63eea3762d57d51081eb848d485012b63e63803453d9912f42ff06
Opcode Fuzzy Hash: 3e72c25e5c980310d69f0fc98d502c706aefd7165560ee14c5a883ad11fb6337
Instruction Fuzzy Hash: 3AF0FC70500219BADB10AB64ED0DF9B366CAB00304F10403AA646F10D0EB7CD725CBA8

Function 00402BFF Relevance: 9.1, APIs: 6, Instructions: 67
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?), ref: 00402C20
RegEnumKeyW.ADVAPI32(?,00000000,?,00000105), ref: 00402C5C
RegCloseKey.KERNELBASE(?), ref: 00402C65
RegDeleteKeyExW.KERNELBASE(?,?,00000000,00000003), ref: 00402C83
RegCloseKey.ADVAPI32(?), ref: 00402C8A
RegDeleteKeyW.ADVAPI32(?,?), ref: 00402CA8

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseDelete$EnumOpen
String ID:
API String ID: 345360480-0
Opcode ID: 4ec6df6a7822e6832b209296c93603dddbd7b2fdc8aeab19611781db4307b28d
Instruction ID: b9f5b7c8593eadded22e2ca3cbb8d83d08b5e31647f9888e60cfbaa55d101d4e
Opcode Fuzzy Hash: 4ec6df6a7822e6832b209296c93603dddbd7b2fdc8aeab19611781db4307b28d
Instruction Fuzzy Hash: 66116A71504119FFEF10AF90DF8CEAE3B79FB14384B10007AF905E11A0D7B58E55AA69

Function 004031EF Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 101
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00403203

Part of subcall function 0040336E: SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

SetFilePointer.KERNELBASE(00000000,00000000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 00403236
SetFilePointer.KERNELBASE(00415664,00000000,00000000,00414ED0,00004000,?,00000000,00403119,00000004,00000000,00000000,?,?,00403093,000000FF,00000000), ref: 00403331

Strings

@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@, xrefs: 00403248, 004032E3
dVA, xrefs: 004031F2, 0040330F

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer$CountTick
String ID: @@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@$dVA
API String ID: 1092082344-3936939755
Opcode ID: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
Instruction ID: 2fd669d0756999c0d63da40b5d988076205959dac08f3783f289fe1fafb1afdd
Opcode Fuzzy Hash: 7f87ec3f3126c4afc5deb31522855fdbb853a78037bb661dde8e94ffc6001a55
Instruction Fuzzy Hash: 19314B72500204DBD710DF69EEC49663FA9F74075A718423FE900F22E0CBB55D458B9D

Function 00406697 Relevance: 7.7, APIs: 4, Strings: 1, Instructions: 198
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

Strings

@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@, xrefs: 00406697

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID: @@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@
API String ID: 0-2705140028
Opcode ID: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction ID: 5389f57cfb4a3ea8b0a271fe5c21418892ef356aef38e154ca47b5156c43700c
Opcode Fuzzy Hash: a646d1c18714c06b63ca95da94aa03745834858b299022791e2b3ebf89425e7d
Instruction Fuzzy Hash: 37816831D04229CBDF24CFA8C844BADBBB0FF44305F11816AD956BB281D7785986DF45

Function 00401767 Relevance: 7.6, APIs: 5, Instructions: 145
stringtimeCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

lstrcatW.KERNEL32(00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017A8
CompareFileTime.KERNEL32(-00000014,?,0040A5D8,0040A5D8,00000000,00000000,0040A5D8,00436000,?,?,00000031), ref: 004017CD

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$lstrcatlstrlen$CompareFileTextTimeWindowlstrcpyn
String ID:
API String ID: 1941528284-0
Opcode ID: 691a1510b89acce80dd3805f8ce29c63c215ef208285089eafd6533280d8da0c
Instruction ID: b64174440326d41e90dd14f1ad6608c73badddfa8ee8632f400ec40acf256ac3
Opcode Fuzzy Hash: 691a1510b89acce80dd3805f8ce29c63c215ef208285089eafd6533280d8da0c
Instruction Fuzzy Hash: 0C41C431900515BACF117FB5CC46DAE3679EF05329B20827BF422F51E2DA3C86629A6D

Function 00405D82 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 37
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetTickCount.KERNEL32 ref: 00405DA0
GetTempFileNameW.KERNELBASE(?,?,00000000,?,?,?,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,004033B4,00437000,00437800,00437800,00437800,00437800,00437800,00437800,004035DE), ref: 00405DBB

Strings

"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00405D82
nsa, xrefs: 00405D8F

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CountFileNameTempTick
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$nsa
API String ID: 1716503409-1472656423
Opcode ID: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction ID: a69a53d4b23f3d63feeda802a3e8a765614c71270742c911b33c62312df6cecc
Opcode Fuzzy Hash: ba752c91d03ec01f63b9c4f62f06acfe59d2ba7d741f037e803b5e880a418ded
Instruction Fuzzy Hash: 32F06D76600608BBDB008B59DD09AABBBB8EF91710F10803BEE01F7190E6B09A548B64

Function 0040237B Relevance: 6.1, APIs: 4, Instructions: 71
registrystringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegCreateKeyExW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004023B9
lstrlenW.KERNEL32(0040B5D8,00000023,?,?,?,?,?,?,?,00000011,00000002), ref: 004023D9
RegSetValueExW.ADVAPI32(?,?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 00402415
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseCreateValuelstrlen
String ID:
API String ID: 1356686001-0
Opcode ID: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction ID: d84b147cfae213de6894e87518a1957a70c03431d85ade02b305fde94438308f
Opcode Fuzzy Hash: 67c77c8d659d9d4bc82cacddac1e216fe0077c84403bdf1d9c96e54a2d3d16bf
Instruction Fuzzy Hash: E511C071E00108BFEB10AFA4DE89DAE777DEB14358F11403AF904B71D1DBB85E409668

Function 00401E66 Relevance: 6.1, APIs: 4, Instructions: 52
synchronizationCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Part of subcall function 0040585E: CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
Part of subcall function 0040585E: CloseHandle.KERNEL32(?), ref: 00405894

WaitForSingleObject.KERNEL32(00000000,00000064,00000000,000000EB,00000000), ref: 00401E95
WaitForSingleObject.KERNEL32(?,00000064,0000000F), ref: 00401EAA
GetExitCodeProcess.KERNEL32(?,?), ref: 00401EB7
CloseHandle.KERNELBASE(?,00000000,000000EB,00000000), ref: 00401EDE

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$CloseHandleObjectProcessSingleWaitlstrlen$CodeCreateExitTextWindowlstrcat
String ID:
API String ID: 3585118688-0
Opcode ID: a78f467d102d634b70d0cd300a6522cd21a94210720227bbe75178bdad148be0
Instruction ID: 5702df78c33f9bd13decba52644e1012fe72a42f767711efff684f6f7274af03
Opcode Fuzzy Hash: a78f467d102d634b70d0cd300a6522cd21a94210720227bbe75178bdad148be0
Instruction Fuzzy Hash: FF11A131900508EBCF21AF91CD4499E7AB6AF40314F21407BFA05B61F1D7798A92DB99

Function 004057AC Relevance: 6.0, APIs: 4, Instructions: 39COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,?,00437800), ref: 004057EF
GetLastError.KERNEL32 ref: 00405803
SetFileSecurityW.ADVAPI32(?,80000007,00000001), ref: 00405818
GetLastError.KERNEL32 ref: 00405822

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: ErrorLast$CreateDirectoryFileSecurity
String ID:
API String ID: 3449924974-0
Opcode ID: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction ID: b278f7ea68de5888e34302da86fdb06c438f4ef9b03e74a9ab654546e4f81ce2
Opcode Fuzzy Hash: 6ae7c342d9c1b50a082fcf4789916780a4d0616efa07736c5e287c1420eecf92
Instruction Fuzzy Hash: 89010871D00619DADF10DBA0D9447EFBFB8EB04304F00803ADA44B6190E7789618DFA9

Function 004030E7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 88COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,?,?,00403093,000000FF,00000000,00000000,0040A230,?), ref: 0040310C

Strings

dVA, xrefs: 00403101, 004031A1, 004031E1

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer
String ID: dVA
API String ID: 973152223-1571107130
Opcode ID: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction ID: 040f2acbe5348ef8c996952313d322865bd2faa87b76d8d9ba7109e69b0e4b3d
Opcode Fuzzy Hash: 1aa85c7260de761b297061d79344dc340e95e4778a17b24641d9514d9a29d692
Instruction Fuzzy Hash: 22316B30200219EBDB108F55ED84ADA3F68EB08359F20813AF905EA1D0DB79DF50DBA9

Function 00405C3A Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 47stringCOMMON

Download Yara Rule

APIs

Part of subcall function 0040617E: lstrcpynW.KERNEL32(?,?,00000400,00403463,00429240,NSIS Error), ref: 0040618B

Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

lstrlenW.KERNEL32(00425F30,00000000,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405C93
GetFileAttributesW.KERNELBASE(00425F30,00425F30,00425F30,00425F30,00425F30,00425F30,00000000,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0), ref: 00405CA3

Strings

0_B, xrefs: 00405C40

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext$AttributesFilelstrcpynlstrlen
String ID: 0_B
API String ID: 3248276644-2128305573
Opcode ID: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction ID: 790be11e20efdccda9c73cacd4945748764c6204d4d0b11914a12a4c94a1ccfd
Opcode Fuzzy Hash: 8c509004bd2409bcc8bce800ca11afa93321ed7f3e6ee2afcf27be4b7ee26805
Instruction Fuzzy Hash: 41F0F925108F6515F62233790D05EAF2554CF82394755067FF891B12D1DB3C9D938C7D

Function 00406C7B Relevance: 5.2, APIs: 4, Instructions: 236COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction ID: 95c87b37ce546c92696c349aad8761a6baa0f42cb897a758cf539d426e2a5a70
Opcode Fuzzy Hash: 6748365695d0b60958ae2de605dce3010a9a46cb287cd8314348fa6e45a6e7ef
Instruction Fuzzy Hash: 65A13471D00229CBDF28CFA8C844AADBBB1FF44305F15816AD956BB281D7785A86DF44

Function 00406E7C Relevance: 5.2, APIs: 4, Instructions: 208COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction ID: dd225a6952a4a1885b566de7f95e3528e0c965b1b64db9b9769652e5c735704b
Opcode Fuzzy Hash: e6b96a49f958b7a8d2aa4cc917083ea926a28b83a61870a924df7985f049b653
Instruction Fuzzy Hash: 3D913370D04229CBDF28CFA8C844BADBBB1FF44305F15816AD856BB291C7789A86DF45

Function 00406B92 Relevance: 5.2, APIs: 4, Instructions: 205COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction ID: c728d5504c89e28601c55753f21d2f559f3974f1a6ce44cf054f885a45476dee
Opcode Fuzzy Hash: 683f34e5330f3119535e65c3fcc014917b66dea9351a733ad05ad489270f429c
Instruction Fuzzy Hash: 06813471D04228CFDF24CFA8C844BADBBB1FB44305F25816AD856BB291C7789A86DF45

Function 00406AE5 Relevance: 5.2, APIs: 4, Instructions: 180COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction ID: 7cecadd07089ef5f508d2048bcf4206a214b5fe31ba49bd0cdf53ec9cfb3ce0b
Opcode Fuzzy Hash: 96da27bd456154c1aedaa85bcfc68d0a261e277abb4cee4e4020ac7d50c7f0c5
Instruction Fuzzy Hash: 35712175D04228CBDF28CFA8C844BADBBB1FB44305F15816AD806BB281D7789A96DF44

Function 00406C03 Relevance: 5.2, APIs: 4, Instructions: 170COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction ID: f96eec566abe8136b7696836c8602221009d3abbc3cba5cf828ad5cd02611e0d
Opcode Fuzzy Hash: 29e3b149f88ae6fd458fdcc74d478f48b2ed7dfe8c3e809ea2d72e9fd2fa3729
Instruction Fuzzy Hash: 56713371D04228CBEF28CFA8C844BADBBB1FF44305F15816AD856BB281C7789996DF45

Function 00406B4F Relevance: 5.2, APIs: 4, Instructions: 168COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction ID: 17f295adf0ba2181094cfffbed918b39bb4908eb68d6975640ddb9889f0749db
Opcode Fuzzy Hash: b9c673c2534040230f9089defbd7d825788091a80835a4c341425c1e948b069d
Instruction Fuzzy Hash: F2714531D04229CBEF28CF98C844BADBBB1FF44305F11816AD816BB291C7785A96DF44

Function 00401FC3 Relevance: 4.6, APIs: 3, Instructions: 73libraryCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNELBASE(00000000,00000001,000000F0), ref: 00401FEE

Part of subcall function 004052DD: lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
Part of subcall function 004052DD: lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
Part of subcall function 004052DD: lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
Part of subcall function 004052DD: SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
Part of subcall function 004052DD: SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
Part of subcall function 004052DD: SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

LoadLibraryExW.KERNEL32(00000000,?,00000008,00000001,000000F0), ref: 00401FFF
FreeLibrary.KERNELBASE(?,?,000000F7,?,?,00000008,00000001,000000F0), ref: 0040207C

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Librarylstrlen$FreeHandleLoadModuleTextWindowlstrcat
String ID:
API String ID: 334405425-0
Opcode ID: 3af2946ff99008b209debd4f1eb8d373454f26c3ddb3991e3b063650c9d6d31f
Instruction ID: 135227bab5bbd0cb957ad13063370cb04025123e1843093ab7a3381522db9c00
Opcode Fuzzy Hash: 3af2946ff99008b209debd4f1eb8d373454f26c3ddb3991e3b063650c9d6d31f
Instruction Fuzzy Hash: 7D21A731900219EBCF20AFA5CE48A9E7E71BF00354F20427BF511B51E1DBBD8A81DA5D

Function 00402537 Relevance: 4.6, APIs: 3, Instructions: 67stringCOMMON

Download Yara Rule

APIs

WideCharToMultiByte.KERNEL32(?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 00402583
lstrlenA.KERNEL32(0040ADD8,?,?,0040B5D8,000000FF,0040ADD8,00000400,?,?,00000021), ref: 0040258E

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: ByteCharMultiWidelstrlen
String ID:
API String ID: 3109718747-0
Opcode ID: e7f3211d175e5301a81dcf8418a50b190afa44f623bbf1836edc17c3b72aee6a
Instruction ID: 4789cac02ba757069cd1743e95fa376523a080456913a55bd7acca95e4ec0b97
Opcode Fuzzy Hash: e7f3211d175e5301a81dcf8418a50b190afa44f623bbf1836edc17c3b72aee6a
Instruction Fuzzy Hash: CA11E772A01204BADB10AFB18F4EE9E32659F54355F20403BF502F65C1DAFC8E51576E

Function 0040604B Relevance: 4.5, APIs: 3, Instructions: 45registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(?,?,00000000,?,?,00000002,004281E0,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 00406075
RegQueryValueExW.KERNELBASE(?,?,00000000,?,?,?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 00406096
RegCloseKey.KERNELBASE(?,?,004062BE,80000002,Software\Microsoft\Windows\CurrentVersion,?,004281E0,?), ref: 004060B9

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction ID: 0186f18981595c0b19feb364ea02d5f95392918b8fa258a18f8687652683a575
Opcode Fuzzy Hash: dc8238eba50b6a515ffb3eaa529f07d06f955d85da5af348ba8f56d7e8cd44ce
Instruction Fuzzy Hash: 4501483115020AEADF21CF66ED08E9B3BA8EF84390B01402AF845D2220D735D964DBA5

Function 0040249E Relevance: 4.5, APIs: 3, Instructions: 44registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegEnumKeyW.ADVAPI32(00000000,00000000,?,000003FF), ref: 004024CD
RegEnumValueW.ADVAPI32(00000000,00000000,?,?,?,?,?,?,00000003), ref: 004024E0
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Enum$CloseOpenValue
String ID:
API String ID: 167947723-0
Opcode ID: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
Instruction ID: c7ec42ec2a5b8cbcf97019b844e04a4f9c539befeef3331d530b96059407f5ff
Opcode Fuzzy Hash: 60ac1395f0a982b77a3977587a1bd86f46e362b2f506b0714e0df90dc524a01b
Instruction Fuzzy Hash: FCF03171A14204EBEB209F65DE8CABF767DEF80354B10843FF505B61D0DAB84D419B69

Function 00405927 Relevance: 4.5, APIs: 3, Instructions: 28fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00405D2E: GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
Part of subcall function 00405D2E: SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

RemoveDirectoryW.KERNELBASE(?,?,?,00000000,00405B09), ref: 00405942
DeleteFileW.KERNELBASE(?,?,?,00000000,00405B09), ref: 0040594A
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405962

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$Attributes$DeleteDirectoryRemove
String ID:
API String ID: 1655745494-0
Opcode ID: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction ID: ecea3d8082f0941e5ee01c5501cf82e541f4c7e763f85e657b920a2cf98d934c
Opcode Fuzzy Hash: 4d7e10e481d95c5c5c7c05f6c7e2fdde8e74fc3924f4c20308c7a9621a850695
Instruction Fuzzy Hash: 6EE09B72105A91D6D21067349E0CB5F2AD8DF96335F09493EF595F11D0C778880ACA7D

Function 004038D5 Relevance: 4.5, APIs: 2, Strings: 1, Instructions: 20COMMON

Download Yara Rule

APIs

CloseHandle.KERNEL32(FFFFFFFF,00437800,00403708,?), ref: 004038E7
CloseHandle.KERNEL32(FFFFFFFF,00437800,00403708,?), ref: 004038FB

Strings

C:\Windows\TEMP\nsfB965.tmp\, xrefs: 0040390B

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseHandle
String ID: C:\Windows\TEMP\nsfB965.tmp\
API String ID: 2962429428-4101858002
Opcode ID: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction ID: 23b98c188a40640ee87c89e263e7d2a3484f90a0975adae1b2ea6fd77d705eba
Opcode Fuzzy Hash: f084a8137c272c7609008576fb265960e9ac12256820a4da339362f4de570230
Instruction Fuzzy Hash: 78E086B14407149AC124AF7CAD495853A185F453357248726F178F20F0C778996B5E9D

Function 00405E05 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

WriteFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414BCB,@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@,004032EF,@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@,00414BCB,00414ED0,00004000,?,00000000,00403119,00000004), ref: 00405E19

Strings

@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@, xrefs: 00405E05

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileWrite
String ID: @@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@
API String ID: 3934441357-2705140028
Opcode ID: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction ID: dac0b8971ba2920abb5474f128329a0fa477ab7403896bbfc0984bb8014ca22f
Opcode Fuzzy Hash: 6919b523ba5b1b84b4b924eeaf28b73d4aab7fc63dbc8f700f0d9cb823d33c03
Instruction Fuzzy Hash: 4AE08632100119ABCF105F50DC00EEB376CEB00350F004832FA65E2040E230EA219BE4

Function 00405DD6 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNELBASE(0040A230,00000000,00000000,00000000,00000000,00414ED0,@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@,0040336B,0040A230,0040A230,0040326F,00414ED0,00004000,?,00000000,00403119), ref: 00405DEA

Strings

@@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@, xrefs: 00405DD6

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileRead
String ID: @@@DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD@@@
API String ID: 2738559852-2705140028
Opcode ID: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction ID: f39de87387fc754cac4ceee649b5e38243fe2bf9183d254406dbd5143e25ae03
Opcode Fuzzy Hash: 367723d41a66009c2099c483b716accd4a6fea8915a9694eb2152ff5aa97eb4c
Instruction Fuzzy Hash: 57E0EC3221125AABDF509F65DC08AEB7B6DEF05360F008837F955E6160D631E9219BE8

Function 004015B9 Relevance: 3.1, APIs: 2, Instructions: 65COMMON

Download Yara Rule

APIs

Part of subcall function 00405BDD: CharNextW.USER32(?,?,00425F30,?,00405C51,00425F30,00425F30,74DF3420,?,74DF2EE0,0040598F,?,74DF3420,74DF2EE0,00000000), ref: 00405BEB
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405BF0
Part of subcall function 00405BDD: CharNextW.USER32(00000000), ref: 00405C08

GetFileAttributesW.KERNELBASE(?,?,00000000,0000005C,00000000,000000F0), ref: 00401612

Part of subcall function 004057AC: CreateDirectoryW.KERNELBASE(?,?,00437800), ref: 004057EF

SetCurrentDirectoryW.KERNEL32(?,00436000,?,00000000,000000F0), ref: 00401645

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharNext$Directory$AttributesCreateCurrentFile
String ID:
API String ID: 1892508949-0
Opcode ID: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction ID: 18abe7de9e9977a76830232601504265d2e6edcedfe07fce7f69d5744a4425eb
Opcode Fuzzy Hash: 2305ffb504cd1727ef0d2f6d990949bd10217623809cec2c7a11ebe9bcb6ddd7
Instruction Fuzzy Hash: F911E631500504EBCF207FA0CD0199E3AB2EF44364B25453BF906B61F2DA3D4A819E5E

Function 0040242A Relevance: 3.1, APIs: 2, Instructions: 56registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegQueryValueExW.KERNELBASE(00000000,00000000,?,?,?,?), ref: 0040245B
RegCloseKey.KERNELBASE(?,?,?,0040B5D8,00000000,?,?,?,?,?,?,?,00000011,00000002), ref: 004024F6

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID:
API String ID: 3677997916-0
Opcode ID: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
Instruction ID: a4ed2935f8c713a64b441f8b02302a8faa8aa65f3841d01997d269d515fb9b23
Opcode Fuzzy Hash: 7c5d0e18f6a429da2bc85dc3c2d089be0215a696c23f31d9e61351b332a472c5
Instruction Fuzzy Hash: 9D119131911205EBDB10CFA0CA489AEB7B4EF44354B20843FE446B72D0D6B85A41DB19

Function 00401389 Relevance: 3.0, APIs: 2, Instructions: 43windowCOMMON

Download Yara Rule

APIs

MulDiv.KERNEL32(00007530,00000000,00000000), ref: 004013E4
SendMessageW.USER32(00000402,00000402,00000000), ref: 004013F4

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction ID: d65e0694727b7210e6f7bc09f77efd2c0147e56cffd904cd4a2c980f2ed28b93
Opcode Fuzzy Hash: 3ee467f7d586eb782eae2bae36c3decf9d7e0780ea8b642ce91f4ebf2c7a7eb5
Instruction Fuzzy Hash: 3D01D131724210EBEB195B789D04B2A3698E714314F1089BAF855F62F1DA788C128B5D

Function 0040231F Relevance: 3.0, APIs: 2, Instructions: 40registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00402CC9: RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

RegDeleteValueW.ADVAPI32(00000000,00000000,00000033), ref: 0040233E
RegCloseKey.ADVAPI32(00000000), ref: 00402347

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseDeleteOpenValue
String ID:
API String ID: 849931509-0
Opcode ID: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
Instruction ID: b5033fe3495a5d5fbf66e52db86fe43622c16bf705f2fe0f4142c4154f9543e6
Opcode Fuzzy Hash: af1b21a11892d4ef4174ae2b41b7854131aa20919259ada3e53a4d904ddc093b
Instruction Fuzzy Hash: 45F04F32A04110ABEB11BFB59B4EABE726A9B40314F15807BF501B71D5D9FC99025629

Function 00406594 Relevance: 3.0, APIs: 2, Instructions: 24windowCOMMON

Download Yara Rule

APIs

DispatchMessageW.USER32(?), ref: 004065AB
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 004065BB

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Message$DispatchPeek
String ID:
API String ID: 1770753511-0
Opcode ID: ef2e4593c0240a07502a9f68f436a2f199b7ff7db9f8b56736ff16cb35fdca16
Instruction ID: 3df2e48da143b1230ddfac55cbc283c178fe6404b28bee855849021750633643
Opcode Fuzzy Hash: ef2e4593c0240a07502a9f68f436a2f199b7ff7db9f8b56736ff16cb35fdca16
Instruction Fuzzy Hash: EBE086B790111876CA10A799AD05ECB776C9B95750F014036F611F3085D678E5118AB4

Function 00406558 Relevance: 3.0, APIs: 2, Instructions: 22libraryloaderCOMMON

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,00000020,?,0040341F,00000009), ref: 0040656A
GetProcAddress.KERNEL32(00000000,?), ref: 00406585

Part of subcall function 004064E8: GetSystemDirectoryW.KERNEL32(?,00000104), ref: 004064FF
Part of subcall function 004064E8: wsprintfW.USER32 ref: 0040653A
Part of subcall function 004064E8: LoadLibraryExW.KERNEL32(?,00000000,00000008), ref: 0040654E

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: AddressDirectoryHandleLibraryLoadModuleProcSystemwsprintf
String ID:
API String ID: 2547128583-0
Opcode ID: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
Instruction ID: 8c1a5bb66f910ccc430fc34c4425cef617f316e2833151c7c1ff8c8a0ee84b40
Opcode Fuzzy Hash: 31197a09b32f9822319ed056a1c078f96e3f7aaf520cdba8edd4f010bc886546
Instruction Fuzzy Hash: C3E086326042206BD6105B706E0893762BC9ED8740302483EF946F2084D778DC329A6D

Function 00403932 Relevance: 3.0, APIs: 2, Instructions: 19COMMON

Download Yara Rule

APIs

FreeLibrary.KERNELBASE(?,74DF3420,00000000,74DF2EE0,00403909,00437800,00403708,?), ref: 0040394C
GlobalFree.KERNEL32(?), ref: 00403953

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Free$GlobalLibrary
String ID:
API String ID: 1100898210-0
Opcode ID: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction ID: 420717e04dc644aaadfe3aeddcd4797dc829437e29e913c3c6529364dabb0ba4
Opcode Fuzzy Hash: f4316848cbc6ebdc68634a281282690bfac6e24f3e15d004bec6d27d8a9ac131
Instruction Fuzzy Hash: 41E012739011309BC6225F95ED44B5E7B6D6F95B32F0A423AE9807B26087B45D838FD8

Function 00405D53 Relevance: 3.0, APIs: 2, Instructions: 16fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$AttributesCreate
String ID:
API String ID: 415043291-0
Opcode ID: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction ID: e98dd403a5e5432679a9d4e257ef455d3d6759c2e5ed6cf280caa05d5291d686
Opcode Fuzzy Hash: 7f22f31ca84e25cf3c35cca7fc28e1469c604482c982d9b12555b4894eb7b1e0
Instruction Fuzzy Hash: B3D09E71654601EFEF098F20DF16F2E7AA2EB84B00F11562CB682940E0DA7158199B19

Function 00405D2E Relevance: 3.0, APIs: 2, Instructions: 13COMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNELBASE(?,?,00405933,?,?,00000000,00405B09,?,?,?,?), ref: 00405D33
SetFileAttributesW.KERNELBASE(?,00000000), ref: 00405D47

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: AttributesFile
String ID:
API String ID: 3188754299-0
Opcode ID: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction ID: 62c1218995ad43f24aa052634507c0d83541fa9dca801c4eab67991220ff17ac
Opcode Fuzzy Hash: 2eea293136030474feb3e1a7c5b1a6ed000805180dcccd9d627e45cfe66d6639
Instruction Fuzzy Hash: 40D01272504520AFC2513738EF0C89BBF95EB543B17028B35FAF9A22F0DB304C568A98

Function 00405829 Relevance: 3.0, APIs: 2, Instructions: 9COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNELBASE(?,00000000,004033A9,00437800,00437800,00437800,00437800,00437800,004035DE), ref: 0040582F
GetLastError.KERNEL32 ref: 0040583D

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CreateDirectoryErrorLast
String ID:
API String ID: 1375471231-0
Opcode ID: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction ID: d963a2520b22da8993c1f0374a54a6368e12bf2bf52e26206a68f99a8800bbf8
Opcode Fuzzy Hash: 90cc4c9737d43430731b600de694bcf2d45feac9894761d90dfe22e9228b7257
Instruction Fuzzy Hash: 1DC04C31204B029AD7506B609F097177954AB50781F11C8396946E00A0DE348465DE2D

Function 00401B37 Relevance: 2.6, APIs: 2, Instructions: 72memoryCOMMON

Download Yara Rule

APIs

GlobalFree.KERNEL32(00000000), ref: 00401BA7
GlobalAlloc.KERNELBASE(00000040,00000804), ref: 00401BB9

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Global$AllocFree
String ID:
API String ID: 3394109436-0
Opcode ID: 554d17eb3c6d1829cbb52a784c7af5d6f88ef092a67b5b7707c292645e37930e
Instruction ID: 7cdfc3cbb2e69f4264c6c6693aec6085e55c642d7687a467de19211c04d07d9e
Opcode Fuzzy Hash: 554d17eb3c6d1829cbb52a784c7af5d6f88ef092a67b5b7707c292645e37930e
Instruction Fuzzy Hash: 67219672A00100EBDB20EB94CD85D5E77B6AF84314B21453BF502F72E1DA7898618F5D

Function 00401673 Relevance: 1.5, APIs: 1, Instructions: 38fileCOMMON

Download Yara Rule

APIs

MoveFileW.KERNEL32(00000000,00000000), ref: 0040168E

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileMove
String ID:
API String ID: 3562171763-0
Opcode ID: a51ebfd131b5ce1ad24a1fd58dead1362408043bc730019d15f3e82182553067
Instruction ID: f96437beda5fd31dd1875ddb5f908f1f3267c620ccf54a3d4895ce3c899c2c08
Opcode Fuzzy Hash: a51ebfd131b5ce1ad24a1fd58dead1362408043bc730019d15f3e82182553067
Instruction Fuzzy Hash: 50F0B431604114D7CB20BF7A4F0DD5E32A59F82338B25437BF912B62E6DAFC8A41956E

Function 004027CE Relevance: 1.5, APIs: 1, Instructions: 27fileCOMMON

Download Yara Rule

APIs

FindNextFileW.KERNELBASE(00000000,?,?), ref: 004027E2

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FileFindNext
String ID:
API String ID: 2029273394-0
Opcode ID: cc0804f4c103f793c784cf4c7483c4fcd77a3d298a483efa9ec2adbee381f28d
Instruction ID: 03c77e44a5bd49d5adcbbbc7357f2d618ce2ff781a2b40b59b4f28f65829b406
Opcode Fuzzy Hash: cc0804f4c103f793c784cf4c7483c4fcd77a3d298a483efa9ec2adbee381f28d
Instruction Fuzzy Hash: D9E06576600115DBCB50DFD0DE48AAEB3B4AF04314F10447BD101F61D1E6F889519B6D

Function 00402786 Relevance: 1.5, APIs: 1, Instructions: 26COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,?,00000000,00000002,?,?), ref: 004027A0

Part of subcall function 004060C5: wsprintfW.USER32 ref: 004060D2

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointerwsprintf
String ID:
API String ID: 327478801-0
Opcode ID: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
Instruction ID: 0f14848d4f24c16631b00b750435c060a764b4453362ef8260df6bafad2d34e7
Opcode Fuzzy Hash: a43271754c7f07c99b9378ce98c7c6ca1c5cab0cf9015cd4f7670726b0543b0b
Instruction Fuzzy Hash: 7FE01A71601114ABDB11EBA59E4ACAE766AAB40328B10443BF501F14E1CAB988619A2E

Function 00402CC9 Relevance: 1.5, APIs: 1, Instructions: 22registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNELBASE(00000000,?,00000000,00000022,00000000,?,?), ref: 00402CF1

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Open
String ID:
API String ID: 71445658-0
Opcode ID: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction ID: ef45ff86538a2d51f1b0222ec8c1b297abd10be8bd22699319dc95f068cee933
Opcode Fuzzy Hash: 2cb17219caef5c2c057f25c6a0d5a563c17eea178cedf0001938d6a474f7be63
Instruction Fuzzy Hash: CCE08676244108BFDB00DFA8DE47FD537ECAB14700F004031BA08D70D1C674E5508768

Function 004022DF Relevance: 1.5, APIs: 1, Instructions: 20COMMON

Download Yara Rule

APIs

GetPrivateProfileStringW.KERNEL32(00000000,?,?,?,000003FF,00000000), ref: 00402310

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: PrivateProfileString
String ID:
API String ID: 1096422788-0
Opcode ID: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction ID: 815fd251d1ef055c124add3867079dbd89389a2e6f50d5753089410e689aa70c
Opcode Fuzzy Hash: 2412c5e6e38f405480bfb5068b9d3e64da5a88d06b16ee9e0a03aeafae2b93d0
Instruction Fuzzy Hash: 91E04F30800208BBDF01AFA4CE49DBD3B79AF00344F14043AF940AB0D5E7F89A819749

Function 0040601F Relevance: 1.5, APIs: 1, Instructions: 13COMMON

Download Yara Rule

APIs

MoveFileExW.KERNELBASE(?,?,00000005,00405B21,?,00000000,000000F1,?,?,?,?,?), ref: 00406029

Part of subcall function 00405EAD: lstrcpyW.KERNEL32(00426DC8,NUL,?,00000000,?,?,00406040,?,?), ref: 00405EBC
Part of subcall function 00405EAD: CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
Part of subcall function 00405EAD: GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9
Part of subcall function 00405EAD: GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
Part of subcall function 00405EAD: wsprintfA.USER32 ref: 00405F24
Part of subcall function 00405EAD: GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
Part of subcall function 00405EAD: GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
Part of subcall function 00405EAD: lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
Part of subcall function 00405EAD: SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$NamePathShortlstrcpy$AllocCloseGlobalHandleMovePointerSizewsprintf
String ID:
API String ID: 2305538632-0
Opcode ID: c3375b46b30391636c211c7ba3bb6b5856b401a82baf414915ce8378752f4d8e
Instruction ID: 18bddb7de20ac1970eb55a3559b5efcfaddd6cd83010f6772ef5631c43e5a1b0
Opcode Fuzzy Hash: c3375b46b30391636c211c7ba3bb6b5856b401a82baf414915ce8378752f4d8e
Instruction Fuzzy Hash: CBD0C73124C601BFDB255B10DD0591B7BA5FB90355F11C43EF595900B2E7368461EF0D

Function 0040336E Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetFilePointer.KERNELBASE(00000000,00000000,00000000,0040306C,?), ref: 0040337C

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: FilePointer
String ID:
API String ID: 973152223-0
Opcode ID: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction ID: 64c0fffafe8abe290eaf2022e63b776f1a4a3bd25e2fde741040b5855636c72c
Opcode Fuzzy Hash: 1c6da78d27ebc38603b4c87e6ff41e0916c1b34e9bb95e36f46a9ca6431a4e31
Instruction Fuzzy Hash: 70B01231140300BFDA214F00DF09F057B21AB90700F10C034B344780F086711075EB0D

Non-executed Functions

Function 00404C59 Relevance: 63.5, APIs: 33, Strings: 3, Instructions: 481windowmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003F9), ref: 00404C71
GetDlgItem.USER32(?,00000408), ref: 00404C7C
GlobalAlloc.KERNEL32(00000040,?), ref: 00404CC6
LoadBitmapW.USER32(0000006E), ref: 00404CD9
SetWindowLongW.USER32(?,000000FC,00405251), ref: 00404CF2
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000006,00000000), ref: 00404D06
ImageList_AddMasked.COMCTL32(00000000,00000000,00FF00FF), ref: 00404D18
SendMessageW.USER32(?,00001109,00000002), ref: 00404D2E
SendMessageW.USER32(?,0000111C,00000000,00000000), ref: 00404D3A
SendMessageW.USER32(?,0000111B,00000010,00000000), ref: 00404D4C
DeleteObject.GDI32(00000000), ref: 00404D4F
SendMessageW.USER32(?,00000143,00000000,00000000), ref: 00404D7A
SendMessageW.USER32(?,00000151,00000000,00000000), ref: 00404D86
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E1C
SendMessageW.USER32(?,0000110A,00000003,00000000), ref: 00404E47
SendMessageW.USER32(?,00001132,00000000,?), ref: 00404E5B
GetWindowLongW.USER32(?,000000F0), ref: 00404E8A
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00404E98
ShowWindow.USER32(?,00000005), ref: 00404EA9
SendMessageW.USER32(?,00000419,00000000,?), ref: 00404FA6
SendMessageW.USER32(?,00000147,00000000,00000000), ref: 0040500B
SendMessageW.USER32(?,00000150,00000000,00000000), ref: 00405020
SendMessageW.USER32(?,00000420,00000000,00000020), ref: 00405044
SendMessageW.USER32(?,00000200,00000000,00000000), ref: 00405064
ImageList_Destroy.COMCTL32(?), ref: 00405079
GlobalFree.KERNEL32(?), ref: 00405089
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00405102
SendMessageW.USER32(?,00001102,?,?), ref: 004051AB
SendMessageW.USER32(?,0000113F,00000000,00000008), ref: 004051BA
InvalidateRect.USER32(?,00000000,00000001), ref: 004051DA
ShowWindow.USER32(?,00000000), ref: 00405228
GetDlgItem.USER32(?,000003FE), ref: 00405233
ShowWindow.USER32(00000000), ref: 0040523A

Strings

, xrefs: 00405212
M, xrefs: 00404E03
N, xrefs: 00404EE4

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Window$ImageItemList_LongShow$Global$AllocBitmapCreateDeleteDestroyFreeInvalidateLoadMaskedObjectRect
String ID: $M$N
API String ID: 1638840714-813528018
Opcode ID: 2479b366cad44d8d2a02fbd124e29c277f71441e1411fda8dea8c44bba4244d6
Instruction ID: ce840dee0c3a5b827351c7f25dbf2e3605d0905f5c54158640504e6bfb71dde6
Opcode Fuzzy Hash: 2479b366cad44d8d2a02fbd124e29c277f71441e1411fda8dea8c44bba4244d6
Instruction Fuzzy Hash: 4C023EB0A00209EFDF209F64CD45AAE7BB5FB84355F10817AE610BA2E1C7799D52CF58

Function 0040541C Relevance: 66.8, APIs: 36, Strings: 2, Instructions: 284windowclipboardmemoryCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000403), ref: 0040547A
GetDlgItem.USER32(?,000003EE), ref: 00405489
GetClientRect.USER32(?,?), ref: 004054C6
GetSystemMetrics.USER32(00000002), ref: 004054CD
SendMessageW.USER32(?,00001061,00000000,?), ref: 004054EE
SendMessageW.USER32(?,00001036,00004000,00004000), ref: 004054FF
SendMessageW.USER32(?,00001001,00000000,00000110), ref: 00405512
SendMessageW.USER32(?,00001026,00000000,00000110), ref: 00405520
SendMessageW.USER32(?,00001024,00000000,?), ref: 00405533
ShowWindow.USER32(00000000,?,0000001B,000000FF), ref: 00405555
ShowWindow.USER32(?,00000008), ref: 00405569
GetDlgItem.USER32(?,000003EC), ref: 0040558A
SendMessageW.USER32(00000000,00000401,00000000,75300000), ref: 0040559A
SendMessageW.USER32(00000000,00000409,00000000,?), ref: 004055B3
SendMessageW.USER32(00000000,00002001,00000000,00000110), ref: 004055BF
GetDlgItem.USER32(?,000003F8), ref: 00405498

Part of subcall function 00404277: SendMessageW.USER32(00000028,?,00000001,004040A3), ref: 00404285

GetDlgItem.USER32(?,000003EC), ref: 004055DC
CreateThread.KERNEL32(00000000,00000000,Function_000053B0,00000000), ref: 004055EA
CloseHandle.KERNEL32(00000000), ref: 004055F1
ShowWindow.USER32(00000000), ref: 00405615
ShowWindow.USER32(?,00000008), ref: 0040561A
ShowWindow.USER32(00000008), ref: 00405664
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405698
CreatePopupMenu.USER32 ref: 004056A9
AppendMenuW.USER32(00000000,00000000,00000001,00000000), ref: 004056BD
GetWindowRect.USER32(?,?), ref: 004056DD
TrackPopupMenu.USER32(00000000,00000180,?,?,00000000,?,00000000), ref: 004056F6
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040572E
OpenClipboard.USER32(00000000), ref: 0040573E
EmptyClipboard.USER32 ref: 00405744
GlobalAlloc.KERNEL32(00000042,00000000), ref: 00405750
GlobalLock.KERNEL32(00000000), ref: 0040575A
SendMessageW.USER32(?,00001073,00000000,?), ref: 0040576E
GlobalUnlock.KERNEL32(00000000), ref: 0040578E
SetClipboardData.USER32(0000000D,00000000), ref: 00405799
CloseClipboard.USER32 ref: 0040579F

Strings

{, xrefs: 00405682
(7B, xrefs: 0040570A

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Window$ItemShow$Clipboard$GlobalMenu$CloseCreatePopupRect$AllocAppendClientDataEmptyHandleLockMetricsOpenSystemThreadTrackUnlock
String ID: (7B${
API String ID: 590372296-525222780
Opcode ID: 7d3ad4f7b905998d9e0ff1ed48f107a225979fc90d670cd13e2faa1d61a6de43
Instruction ID: 3349dadf3efb3a8fdffdb79f187be012afacb07b5928e089a4a7fd9dccbac2fd
Opcode Fuzzy Hash: 7d3ad4f7b905998d9e0ff1ed48f107a225979fc90d670cd13e2faa1d61a6de43
Instruction Fuzzy Hash: 60B15670900608FFDB119FA0DD89EAE3B79FB48354F40847AFA45A61A0CB754E52DF68

Function 00403D6A Relevance: 58.1, APIs: 32, Strings: 1, Instructions: 345windowstringCOMMON

Download Yara Rule

APIs

SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000013), ref: 00403DA6
ShowWindow.USER32(?), ref: 00403DC3
DestroyWindow.USER32 ref: 00403DD7
SetWindowLongW.USER32(?,00000000,00000000), ref: 00403DF3
GetDlgItem.USER32(?,?), ref: 00403E14
SendMessageW.USER32(00000000,000000F3,00000000,00000000), ref: 00403E28
IsWindowEnabled.USER32(00000000), ref: 00403E2F
GetDlgItem.USER32(?,00000001), ref: 00403EDD
GetDlgItem.USER32(?,00000002), ref: 00403EE7
SetClassLongW.USER32(?,000000F2,?), ref: 00403F01
SendMessageW.USER32(0000040F,00000000,00000001,?), ref: 00403F52
GetDlgItem.USER32(?,00000003), ref: 00403FF8
ShowWindow.USER32(00000000,?), ref: 00404019
EnableWindow.USER32(?,?), ref: 0040402B
EnableWindow.USER32(?,?), ref: 00404046
GetSystemMenu.USER32(?,00000000,0000F060,00000001), ref: 0040405C
EnableMenuItem.USER32(00000000), ref: 00404063
SendMessageW.USER32(?,000000F4,00000000,00000001), ref: 0040407B
SendMessageW.USER32(?,00000401,00000002,00000000), ref: 0040408E
lstrlenW.KERNEL32(00423728,?,00423728,00429240), ref: 004040B7
SetWindowTextW.USER32(?,00423728), ref: 004040CB
ShowWindow.USER32(?,0000000A), ref: 004041FF

Strings

(7B, xrefs: 004040A3

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Window$Item$MessageSend$EnableShow$LongMenu$ClassDestroyEnabledSystemTextlstrlen
String ID: (7B
API String ID: 184305955-3251261122
Opcode ID: dd9405652fbbb87ab488d8a14d0aeb81f33be68f6094b2cdc8f2b1d388c01c08
Instruction ID: 4530f9416eb169af0d44378ddba5762a1eee688012323a74912104aead4a3b33
Opcode Fuzzy Hash: dd9405652fbbb87ab488d8a14d0aeb81f33be68f6094b2cdc8f2b1d388c01c08
Instruction Fuzzy Hash: A5C1FFB1640200FFCB206F61EE84E2B3AA8EB95745F40057EF641B21F1CB7999529B6D

Function 004043DF Relevance: 40.5, APIs: 20, Strings: 3, Instructions: 207windowstringCOMMON

Download Yara Rule

APIs

CheckDlgButton.USER32(?,-0000040A,00000001), ref: 0040447D
GetDlgItem.USER32(?,000003E8), ref: 00404491
SendMessageW.USER32(00000000,0000045B,00000001,00000000), ref: 004044AE
GetSysColor.USER32(?), ref: 004044BF
SendMessageW.USER32(00000000,00000443,00000000,?), ref: 004044CD
SendMessageW.USER32(00000000,00000445,00000000,04010000), ref: 004044DB
lstrlenW.KERNEL32(?), ref: 004044E0
SendMessageW.USER32(00000000,00000435,00000000,00000000), ref: 004044ED
SendMessageW.USER32(00000000,00000449,00000110,00000110), ref: 00404502
GetDlgItem.USER32(?,0000040A), ref: 0040455B
SendMessageW.USER32(00000000), ref: 00404562
GetDlgItem.USER32(?,000003E8), ref: 0040458D
SendMessageW.USER32(00000000,0000044B,00000000,00000201), ref: 004045D0
LoadCursorW.USER32(00000000,00007F02), ref: 004045DE
SetCursor.USER32(00000000), ref: 004045E1
ShellExecuteW.SHELL32(0000070B,open,004281E0,00000000,00000000,00000001), ref: 004045F6
LoadCursorW.USER32(00000000,00007F00), ref: 00404602
SetCursor.USER32(00000000), ref: 00404605
SendMessageW.USER32(00000111,00000001,00000000), ref: 00404634
SendMessageW.USER32(00000010,00000000,00000000), ref: 00404646

Strings

open, xrefs: 004045EE
VC@, xrefs: 004045EB
N, xrefs: 0040457B

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Cursor$Item$Load$ButtonCheckColorExecuteShelllstrlen
String ID: N$VC@$open
API String ID: 3615053054-3831744127
Opcode ID: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction ID: ef28e404984a924d02769b335405a58d84a4f5c10dd13b46e9d300bde90bb2c1
Opcode Fuzzy Hash: 33f5e1601642234e7e85cd0b58378a626179fffef457767216124dc14c27a8cd
Instruction Fuzzy Hash: 717191B1A00209BFDB10AF60DD45E6A7B69FB94344F00843AFB05B62E0D779AD51CF98

Function 00401000 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 125COMMON

Download Yara Rule

APIs

DefWindowProcW.USER32(?,00000046,?,?), ref: 0040102C
BeginPaint.USER32(?,?), ref: 00401047
GetClientRect.USER32(?,?), ref: 0040105B
CreateBrushIndirect.GDI32(00000000), ref: 004010CF
FillRect.USER32(00000000,?,00000000), ref: 004010E4
DeleteObject.GDI32(?), ref: 004010ED
CreateFontIndirectW.GDI32(?), ref: 00401105
SetBkMode.GDI32(00000000,00000001), ref: 00401126
SetTextColor.GDI32(00000000,000000FF), ref: 00401130
SelectObject.GDI32(00000000,?), ref: 00401140
DrawTextW.USER32(00000000,00429240,000000FF,00000010,00000820), ref: 00401156
SelectObject.GDI32(00000000,00000000), ref: 00401160
DeleteObject.GDI32(?), ref: 00401165
EndPaint.USER32(?,?), ref: 0040116E

Strings

F, xrefs: 0040100C

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Object$CreateDeleteIndirectPaintRectSelectText$BeginBrushClientColorDrawFillFontModeProcWindow
String ID: F
API String ID: 941294808-1304234792
Opcode ID: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction ID: fbc3582f0be17511ef24b6208279bd62f68a22b1f89f17edcf88e24f0ff4dafb
Opcode Fuzzy Hash: 709e975422cda7ccbb1a7a25ffea5b6ea87087be701c8afe7ff27c60fd663942
Instruction Fuzzy Hash: 8E418A71800209AFCF058F95DE459AFBBB9FF44310F00842EF991AA1A0C738EA55DFA4

Function 00405EAD Relevance: 24.6, APIs: 11, Strings: 3, Instructions: 131stringmemoryCOMMON

Download Yara Rule

APIs

lstrcpyW.KERNEL32(00426DC8,NUL,?,00000000,?,?,00406040,?,?), ref: 00405EBC
CloseHandle.KERNEL32(00000000,?,00000000,00000001,?,?,00406040,?,?), ref: 00405EE0
GetShortPathNameW.KERNEL32(?,00426DC8,00000400), ref: 00405EE9

Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
Part of subcall function 00405CB8: lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

GetShortPathNameW.KERNEL32(004275C8,004275C8,00000400), ref: 00405F06
wsprintfA.USER32 ref: 00405F24
GetFileSize.KERNEL32(00000000,00000000,004275C8,C0000000,00000004,004275C8,?,?,?,?,?), ref: 00405F5F
GlobalAlloc.KERNEL32(00000040,0000000A,?,?,?,?), ref: 00405F6E
lstrcpyA.KERNEL32(00000000,[Rename],00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405FA6
SetFilePointer.KERNEL32(0040A588,00000000,00000000,00000000,00000000,004269C8,00000000,-0000000A,0040A588,00000000,[Rename],00000000,00000000,00000000), ref: 00405FFC
GlobalFree.KERNEL32(00000000), ref: 0040600D
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00406014

Part of subcall function 00405D53: GetFileAttributesW.KERNELBASE(00000003,00402E84,C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe,80000000,00000003), ref: 00405D57
Part of subcall function 00405D53: CreateFileW.KERNELBASE(?,?,00000001,00000000,?,00000001,00000000), ref: 00405D79

Strings

NUL, xrefs: 00405EB6
[Rename], xrefs: 00405F8E, 00405FA0
%ls=%ls, xrefs: 00405F1A

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$CloseGlobalHandleNamePathShortlstrcpylstrlen$AllocAttributesCreateFreePointerSizewsprintf
String ID: %ls=%ls$NUL$[Rename]
API String ID: 222337774-899692902
Opcode ID: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
Instruction ID: 52ae09e4e2a5e81e4d5588e003ad531eff1fe7f7ae6e2de5146a23cae23f7ad9
Opcode Fuzzy Hash: b79c81f05b1b833d126071e3cf8f1dbc038624686787cc5f02dad872694d8803
Instruction Fuzzy Hash: EB315330241B19BBD2206B209D08F2B3A5CEF85758F15043BF942F62C2EA7CC9118EBD

Function 004046DD Relevance: 23.0, APIs: 10, Strings: 3, Instructions: 275stringCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003FB), ref: 0040472C
SetWindowTextW.USER32(00000000,?), ref: 00404756
SHBrowseForFolderW.SHELL32(?), ref: 00404807
CoTaskMemFree.OLE32(00000000), ref: 00404812
lstrcmpiW.KERNEL32(004281E0,00423728,00000000,?,?), ref: 00404844
lstrcatW.KERNEL32(?,004281E0), ref: 00404850
SetDlgItemTextW.USER32(?,000003FB,?), ref: 00404862

Part of subcall function 004058A7: GetDlgItemTextW.USER32(?,?,00000400,00404899), ref: 004058BA

Part of subcall function 00406412: CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406475
Part of subcall function 00406412: CharNextW.USER32(?,?,?,00000000), ref: 00406484
Part of subcall function 00406412: CharNextW.USER32(?,00000000,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406489
Part of subcall function 00406412: CharPrevW.USER32(?,?,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 0040649C

GetDiskFreeSpaceW.KERNEL32(004216F8,?,?,0000040F,?,004216F8,004216F8,?,00000001,004216F8,?,?,000003FB,?), ref: 00404925
MulDiv.KERNEL32(?,0000040F,00000400), ref: 00404940

Part of subcall function 00404A99: lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
Part of subcall function 00404A99: wsprintfW.USER32 ref: 00404B43
Part of subcall function 00404A99: SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

(7B, xrefs: 004047DA
A, xrefs: 00404800
C:\Program Files\TeamViewer, xrefs: 0040482D

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CharItemText$Next$Free$BrowseDiskFolderPrevSpaceTaskWindowlstrcatlstrcmpilstrlenwsprintf
String ID: (7B$A$C:\Program Files\TeamViewer
API String ID: 2624150263-460036527
Opcode ID: b1c988a2c75076f1e590c134e256cc95cfc43452e7a67f3061b6eea54995cb3a
Instruction ID: d5aaf60bd55b21875b9c8b9a8d0b3d7e01f34e6f89f3adcbdcc63617e1d21faf
Opcode Fuzzy Hash: b1c988a2c75076f1e590c134e256cc95cfc43452e7a67f3061b6eea54995cb3a
Instruction Fuzzy Hash: B7A191F1A00209ABDB11AFA5CC45AAF77B8EF84354F10847BF601B62D1D77C99418B6D

Function 004042A9 Relevance: 12.1, APIs: 8, Instructions: 61COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EB), ref: 004042C6
GetSysColor.USER32(00000000), ref: 004042E2
SetTextColor.GDI32(?,00000000), ref: 004042EE
SetBkMode.GDI32(?,?), ref: 004042FA
GetSysColor.USER32(?), ref: 0040430D
SetBkColor.GDI32(?,?), ref: 0040431D
DeleteObject.GDI32(?), ref: 00404337
CreateBrushIndirect.GDI32(?), ref: 00404341

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Color$BrushCreateDeleteIndirectLongModeObjectTextWindow
String ID:
API String ID: 2320649405-0
Opcode ID: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction ID: 2a82f640caf94e13ad52f77eccc7f6a005bf570db5d4005cc44859485eb84fad
Opcode Fuzzy Hash: c443cadc41ebc586ff1270cf4c3a90a0d5c0685d314312a93ad56e7471fbb8ef
Instruction Fuzzy Hash: 9F215171600704ABCB219F68DE08B4BBBF8AF81714F04892DED95E26A0D738E904CB64

Function 004025E5 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 151fileCOMMON

Download Yara Rule

APIs

ReadFile.KERNEL32(?,?,?,?), ref: 0040264D
MultiByteToWideChar.KERNEL32(?,00000008,?,?,?,00000001), ref: 00402688
SetFilePointer.KERNEL32(?,?,?,00000001,?,00000008,?,?,?,00000001), ref: 004026AB
MultiByteToWideChar.KERNEL32(?,00000008,?,00000000,?,00000001,?,00000001,?,00000008,?,?,?,00000001), ref: 004026C1

Part of subcall function 00405E34: SetFilePointer.KERNEL32(?,00000000,00000000,00000001), ref: 00405E4A

SetFilePointer.KERNEL32(?,?,?,00000001,?,?,00000002), ref: 0040276D

Strings

9, xrefs: 00402630

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: File$Pointer$ByteCharMultiWide$Read
String ID: 9
API String ID: 163830602-2366072709
Opcode ID: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction ID: fbd7f9394f7a40dbbdef10ea3a20ac1ae57b35180e29dd1ddeb30b88b5afce05
Opcode Fuzzy Hash: 01588cc1e6d12b9eb48a34a041857950361e167f935f48975bd7f3d5c8a3ade6
Instruction Fuzzy Hash: 19510774D00219ABDF209F94CA88AAEB779FF04344F50447BE501B72E0D7B99982DB69

Function 004052DD Relevance: 10.6, APIs: 7, Instructions: 72stringwindowCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000,?), ref: 00405315
lstrlenW.KERNEL32(00402E19,00422708,00000000,00000000,00000000,?,?,?,?,?,?,?,?,?,00402E19,00000000), ref: 00405325
lstrcatW.KERNEL32(00422708,00402E19,00402E19,00422708,00000000,00000000,00000000), ref: 00405338
SetWindowTextW.USER32(00422708,00422708), ref: 0040534A
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00405370
SendMessageW.USER32(?,0000104D,00000000,00000001), ref: 0040538A
SendMessageW.USER32(?,00001013,?,00000000), ref: 00405398

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$lstrlen$TextWindowlstrcat
String ID:
API String ID: 2531174081-0
Opcode ID: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
Instruction ID: d14990956ab1253184f877e9e8298894284f42a30aea32824f5004b5108fa95f
Opcode Fuzzy Hash: e0d278b4f454602652d1392a5fb3045d02927be56822f9b38c604404e895085a
Instruction Fuzzy Hash: 62217F71900518BACF119FA6DD44ACFBFB8EF85354F10807AF904B62A1C7B94A51DFA8

Function 00406412 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 69COMMON

Download Yara Rule

APIs

CharNextW.USER32(?,*?|<>/":,00000000,00000000,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406475
CharNextW.USER32(?,?,?,00000000), ref: 00406484
CharNextW.USER32(?,00000000,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 00406489
CharPrevW.USER32(?,?,74DF3420,00437800,"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE,00403391,00437800,00437800,004035DE), ref: 0040649C

Strings

*?|<>/":, xrefs: 00406464
"C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE, xrefs: 00406412

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Char$Next$Prev
String ID: "C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe" /RESTORE$*?|<>/":
API String ID: 589700163-1805722269
Opcode ID: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction ID: c1b46f2de1f90aebbf911330ce555e940da56993e608f70b6a8db31027969b8c
Opcode Fuzzy Hash: 3235da6fa7aa45e9bf0ecdfd9fa5d30a804d535f67a6192059b6605710e04147
Instruction Fuzzy Hash: 5311C85680121299DB307B588C40AB7A2B8EF55754F52803FEDCA732C1E77C5C9286BD

Function 00404BA7 Relevance: 10.5, APIs: 5, Strings: 1, Instructions: 48windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00404BC2
GetMessagePos.USER32 ref: 00404BCA
ScreenToClient.USER32(?,?), ref: 00404BE4
SendMessageW.USER32(?,00001111,00000000,?), ref: 00404BF6
SendMessageW.USER32(?,0000113E,00000000,?), ref: 00404C1C

Strings

f, xrefs: 00404BF8

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Message$Send$ClientScreen
String ID: f
API String ID: 41195575-1993550816
Opcode ID: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction ID: 45e0f6331f39cfe7836e80c9775163861a3897288b26a0b158bc224782e9bc0b
Opcode Fuzzy Hash: 0086211f2de0e1ca33d279ef662edcfa4b2f35d2ca496e99dd6aa4820b9c6f7a
Instruction Fuzzy Hash: C9015271901218BAEB00DB94DD45FFEBBBCAF54711F10012BBA51B61D0C7B495018B54

Function 00402840 Relevance: 9.1, APIs: 6, Instructions: 86memoryfileCOMMON

Download Yara Rule

APIs

GlobalAlloc.KERNEL32(00000040,?,00000000,40000000,00000002,00000000,00000000), ref: 00402894
GlobalAlloc.KERNEL32(00000040,?,00000000,?), ref: 004028B0
GlobalFree.KERNEL32(?), ref: 004028E9
GlobalFree.KERNEL32(00000000), ref: 004028FC
CloseHandle.KERNEL32(?), ref: 00402914
DeleteFileW.KERNEL32(?,00000000,40000000,00000002,00000000,00000000), ref: 00402928

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Global$AllocFree$CloseDeleteFileHandle
String ID:
API String ID: 2667972263-0
Opcode ID: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
Instruction ID: 9003099e8900d80eaa65f9bf21adae6f43ee9946aaa6f9d478ae9c17af360c06
Opcode Fuzzy Hash: 268536b817805fd7c6aa0ddf0c0313c96854f1d95891718e15f9d7c13f840f6f
Instruction Fuzzy Hash: D6216F72801118BBCF216FA5CE49D9E7F79EF09364F24423AF550762E0CB794E419B98

Function 00404A99 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 84stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(00423728,00423728,?,%u.%u%s%s,00000005,00000000,00000000,?,000000DC,00000000,?,000000DF,00000000,00000400,?), ref: 00404B3A
wsprintfW.USER32 ref: 00404B43
SetDlgItemTextW.USER32(?,00423728), ref: 00404B56

Strings

(7B, xrefs: 00404B2C
%u.%u%s%s, xrefs: 00404B24

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: ItemTextlstrlenwsprintf
String ID: %u.%u%s%s$(7B
API String ID: 3540041739-1320723960
Opcode ID: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
Instruction ID: 8555a1dc09e6b234f76c08cd80d60a8511de1cbf1cdbca66d7a603e4fd23a7b2
Opcode Fuzzy Hash: 97f8edb7a0e5a20212aa5a449d05d7effc420c8931a1b74a790ae22a69f051c3
Instruction Fuzzy Hash: E911EB736441283BDB0095AD9C45F9E3298DB85378F150237FA26F71D1DA79D82286EC

Function 00401CFA Relevance: 7.5, APIs: 5, Instructions: 39windowCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,?), ref: 00401D00
GetClientRect.USER32(00000000,?), ref: 00401D0D
LoadImageW.USER32(?,00000000,?,?,?,?), ref: 00401D2E
SendMessageW.USER32(00000000,00000172,?,00000000), ref: 00401D3C
DeleteObject.GDI32(00000000), ref: 00401D4B

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: ClientDeleteImageItemLoadMessageObjectRectSend
String ID:
API String ID: 1849352358-0
Opcode ID: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction ID: c287ee2e14a47dfcdc45124cadc9b4dd0eb33b5564dd8f2f51e592e83ba53e14
Opcode Fuzzy Hash: 6491dc860a80c02085eecb14b1266a63ebbf57ab5d60057a90a3d7af6463b562
Instruction Fuzzy Hash: 33F0E172600504AFD701DBE4DE88CEEBBBDEB48311B104476F541F51A1CA749D018B38

Function 00401D56 Relevance: 7.5, APIs: 5, Instructions: 38COMMON

Download Yara Rule

APIs

GetDC.USER32(?), ref: 00401D59
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00401D66
MulDiv.KERNEL32(00000000,00000002,00000000), ref: 00401D75
ReleaseDC.USER32(?,00000000), ref: 00401D86
CreateFontIndirectW.GDI32(0040CDE0), ref: 00401DD1

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CapsCreateDeviceFontIndirectRelease
String ID:
API String ID: 3808545654-0
Opcode ID: 020d429652f6eb968a81cc61bdee73d82fb2a6d644655b906a561d6cebbfb8f5
Instruction ID: 9e8fd183d3d9d3ef172346538d4b27734d94fdc92d2c471f4f64b2fa811a60c8
Opcode Fuzzy Hash: 020d429652f6eb968a81cc61bdee73d82fb2a6d644655b906a561d6cebbfb8f5
Instruction Fuzzy Hash: F601A271544641EFEB016BB0AF4AF9A3F75BB65301F104579F152B61E2CA7C0006AB2D

Function 00401BDF Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 76windowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(00000000,00000000,?,?,?,00000002,?), ref: 00401C3F
SendMessageW.USER32(00000000,00000000,?,?), ref: 00401C57

Strings

!, xrefs: 00401C13

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: MessageSend$Timeout
String ID: !
API String ID: 1777923405-2657877971
Opcode ID: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction ID: 9ab6cbc1baff8286944736a18d7265b6422843b7a732a624d4201333bc7942cf
Opcode Fuzzy Hash: 298dafdcb9fb76c6349735f3086c7c7de60bc97eebb8a6152003ba88438aff8e
Instruction Fuzzy Hash: F2219071940209BEEF01AFB5CE4AABE7B75EF44744F10403EFA01B61D1D6B88A409B69

Function 00405251 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00405280
CallWindowProcW.USER32(?,?,?,?), ref: 004052D1

Part of subcall function 0040428E: SendMessageW.USER32(?,00000000,00000000,00000000), ref: 004042A0

Strings

, xrefs: 00405261

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: Window$CallMessageProcSendVisible
String ID:
API String ID: 3748168415-3916222277
Opcode ID: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction ID: 35360b72f4910b777185a6264b25dc7760dbd7dc789205491e41d57b326ac1ec
Opcode Fuzzy Hash: 1c38682ff548693de77d02b4aeee144e7a7efb8abd51762e205331c359b10038
Instruction Fuzzy Hash: 6B019E71210708ABDF208F11DD84E9B3A35EF94321F60443AFA00761D1C77A8D529E6A

Function 0040585E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 24processCOMMON

Download Yara Rule

APIs

CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,04000000,00000000,00000000,00426730,Error launching installer), ref: 00405887
CloseHandle.KERNEL32(?), ref: 00405894

Strings

Error launching installer, xrefs: 00405871

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: CloseCreateHandleProcess
String ID: Error launching installer
API String ID: 3712363035-66219284
Opcode ID: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction ID: 0fb7bd0647ee639374dbc29985885c8cd5f4694ddcbbc5ba66c50ad851a9a680
Opcode Fuzzy Hash: 03ab27a360793ac613c0483ba4ee8f6366951212bcf32abb356d437eb8ce57e6
Instruction Fuzzy Hash: 22E04FB0A002097FEB009B64ED45F7B77ACEB04208F408431BD00F2150D77498248A78

Function 00405CB8 Relevance: 5.0, APIs: 4, Instructions: 37stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CC8
lstrcmpiA.KERNEL32(00000000,00000000), ref: 00405CE0
CharNextA.USER32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CF1
lstrlenA.KERNEL32(00000000,?,00000000,00405F99,00000000,[Rename],00000000,00000000,00000000,?,?,?,?), ref: 00405CFA

Memory Dump Source

Source File: 00000009.00000002.2320050460.0000000000401000.00000020.00000001.01000000.00000015.sdmp, Offset: 00400000, based on PE: true

Associated: 00000009.00000002.2318883540.0000000000400000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320234912.0000000000408000.00000002.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000040A000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000425000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000427000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.000000000042C000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000430000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000435000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2320496080.0000000000438000.00000004.00000001.01000000.00000015.sdmpDownload File
Associated: 00000009.00000002.2321460600.0000000000486000.00000002.00000001.01000000.00000015.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_9_2_400000_TeamViewer_.jbxd

Similarity

API ID: lstrlen$CharNextlstrcmpi
String ID:
API String ID: 190613189-0
Opcode ID: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction ID: b09c91cad7c2282b041c35ea214dbdd3f15ee75aa50bf55fe933874c09a5e2ef
Opcode Fuzzy Hash: d13a305aa79855a3845d1893bd1e44018cb4e3b8a4cc5142433a7699c001be6c
Instruction Fuzzy Hash: BFF0F631104954FFD702DFA5DD04E9FBBA8EF06350B2180BAE841F7210D674DE01ABA8

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches ( `dir /a` for Windows and `ls –a` for Linux and macOS).
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report lz3EbiqoK4.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Quasar

Yara Signatures

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files\TeamViewer\RollbackTemp\TV15Install.log

C:\Program Files\TeamViewer\RollbackTemp\TeamViewer_.exe

C:\Program Files\TeamViewer\TVExtractTemp\CopyrightFULL.txt

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-PipelineConfig.xml

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter-manifest.ini

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.gpd

C:\Program Files\TeamViewer\TVExtractTemp\Printer\TeamViewer_XPSDriverFilter.inf

C:\Program Files\TeamViewer\TVExtractTemp\Printer\teamviewer_xpsdriverfilter.cat

C:\Program Files\TeamViewer\TVExtractTemp\Printer\x64\TeamViewer_XPSDriverFilter.dll

C:\Program Files\TeamViewer\TVExtractTemp\TVWebRTC.dll

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.exe

C:\Program Files\TeamViewer\TVExtractTemp\TeamViewer.ico

Windows Analysis Report
lz3EbiqoK4.exe

Description:	Adversaries may shutdown/reboot systems to interrupt access to, or aid in the destruction of, those systems. Operating systems may contain commands to initiate a shutdown/reboot of a machine or network device. In some cases, these commands may also be used to initiate a shutdown/reboot of a remote computer or network device via Network Device CLI (e.g. `reload` ).
Tactics:	Impact
Data Sources:	Command: Command Execution, Process: Process Creation, Sensor Health: Host Status
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre